eap8-bouncycastle-jmail vulnerabilities (Red Hat)
83 vulnerabilities.
eap8-bouncycastle-jmailRed HatOrg.wildfly.core/wildfly-server: wildfly: rbac bypass in wildfly deployment-operation handlers leads to privilege escalation8.8 Higheap8-bouncycastle-jmailRed HatOpenPGP data signature accepted from a signing subkey without cross-certification8.2 Higheap8-bouncycastle-jmailRed HatPKIXCertPathReviewer does not apply X.509 name constraints to the target certificate8.7 Higheap8-bouncycastle-jmailRed HatApache MINA SSHD: Asynchronous authentication can bypass signature verification9.1 Criticaleap8-bouncycastle-jmailRed HatApache MINA SSHD: Repeated-publickey policy bypass on server8.1 Higheap8-bouncycastle-jmailRed HatApache XMLSchema: Denial of service through deeply nested schema structures7.5 Higheap8-bouncycastle-jmailRed HatApache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes7.5 Higheap8-bouncycastle-jmailRed Hatjackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service7.5 Higheap8-bouncycastle-jmailRed Hatjackson-databind: quadratic forward-reference completion in Collection and Map deserializers7.5 Higheap8-bouncycastle-jmailRed Hatjackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth7.5 Higheap8-bouncycastle-jmailRed Hatjackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS7.5 Higheap8-bouncycastle-jmailRed HatApache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service7.5 Higheap8-bouncycastle-jmailRed HatApache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service7.5 Higheap8-bouncycastle-jmailRed HatApache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion7.5 Higheap8-bouncycastle-jmailRed HatApache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service7.5 Higheap8-bouncycastle-jmailRed HatWildfly-elytron-realm-token: parameter injection in eap's elytron oauth24.2 Mediumeap8-bouncycastle-jmailRed HatOrg.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload5.9 Mediumeap8-bouncycastle-jmailRed HatApache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation7.5 Higheap8-bouncycastle-jmailRed HatApache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription7.5 Higheap8-bouncycastle-jmailRed HatApache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers9.1 Criticaleap8-bouncycastle-jmailRed HatApache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment9.8 Criticaleap8-bouncycastle-jmailRed HatUndertow-core: undertow: denial of service via websocket permessage-deflate processing7.5 Higheap8-bouncycastle-jmailRed HatNetty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass8.7 Higheap8-bouncycastle-jmailRed HatArtemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default8.8 Higheap8-bouncycastle-jmailRed HatUndertow-core: undertow:http request smuggling via oversized chunk-size bit overlap5.3 Mediumeap8-bouncycastle-jmailRed HatWildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener7.5 Higheap8-bouncycastle-jmailRed HatUndertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method7.5 Higheap8-bouncycastle-jmailRed HatWildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos7.4 Higheap8-bouncycastle-jmailRed HatJboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service7.5 Higheap8-bouncycastle-jmailRed HatUndertow-core: oom via missing limits in chunked trailer in eap's undertow7.5 Higheap8-bouncycastle-jmailRed HatOpenjdk-orb: unauthed class loading via iiop in eap8.1 Higheap8-bouncycastle-jmailRed HatJboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller8.8 Higheap8-bouncycastle-jmailRed HatUndertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery7.4 Higheap8-bouncycastle-jmailRed HatIn Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not...7.5 Higheap8-bouncycastle-jmailRed Hatbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation7.5 Higheap8-bouncycastle-jmailRed HatCMS AuthEnvelopedData fails to enforce tag-length on decryption8.7 Higheap8-bouncycastle-jmailRed HatHSS public-key level count unbounded, enabling huge allocation on verify8.7 Higheap8-bouncycastle-jmailRed HatCCM-family modes write plaintext to caller buffer before tag check8.7 Higheap8-bouncycastle-jmailRed HatCMS verifySignatures returns true for SignedData with zero signers8.7 Higheap8-bouncycastle-jmailRed HatCMS AuthenticatedData content not bound to MAC when authAttrs present8.7 Higheap8-bouncycastle-jmailRed HatOER parser recurses without depth limit on self-referential IEEE 1609.2 schema8.7 Higheap8-bouncycastle-jmailRed HatOpenPGP user-attribute subpacket length bounded only by JVM max memory8.7 Higheap8-bouncycastle-jmailRed Hatjackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)8.7 Higheap8-bouncycastle-jmailRed Hatjackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization6.5 Mediumeap8-bouncycastle-jmailRed HatJastow: jastow cross-site scripting attack due to unsanitized uri6.5 Mediumeap8-bouncycastle-jmailRed Hatjackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation8.1 Higheap8-bouncycastle-jmailRed Hatjackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)8.1 Higheap8-bouncycastle-jmailRed Hatjackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties5.3 Mediumeap8-bouncycastle-jmailRed HatApache CXF: JNDI Injection Vulnerability in JMSConfigFactory8.1 Higheap8-bouncycastle-jmailRed HatApache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils9.8 Critical- Show moreLoading…