Skip to contentRed Hat Jboss Enterprise Application Platform 8 vulnerabilities
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel 4.14.2 for spring boot 3.5.8 +32 more +34 moreUndertow: undertow madeyoureset http/2 ddos vulnerabilityCVE-2025-9784Public exploitFix available7.5 High
- red hat build of keycloak 26, build of keycloak 26.2, jboss enterprise application platform 8 +3 more +5 moreOrg.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)CVE-2025-7784Fix available6.5 Medium
- infinispan, red hat data grid 8.5.4, jboss enterprise application platform 7 +4 more +6 moreInfinispan: credential leakage in infinispan cliCVE-2025-57315.5 Medium
- red hat jboss enterprise application platform 7, jboss enterprise application platform 7.4 for rhel 8, jboss enterprise application platform 7.4 for rhel 9 +5 more +7 moreOrg.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code executionCVE-2025-22516.2 Medium
- image-size, red hat gatekeeper 3, build of podman desktop +15 more +17 moreimage-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF ParserCVE-2025-71319Fix available8.7 High
- red hat build of apache camel 4.8 for quarkus 3.15, build of apache camel 4.8.5 for spring boot, build of apicurio registry 2 +8 more +10 moreSmallrye-fault-tolerance: smallrye fault toleranceCVE-2025-2240Fix available7.5 High
- red hat build of keycloak, data grid 8, fuse 7 +13 more +15 moreOrg.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cliCVE-2025-23368Fix available8.1 High
- redhat wildfly, red hat build of keycloak, data grid 8 +14 more +16 moreOrg.wildfly.core:wildfly-server: wildfly improper rbac permissionCVE-2025-23367Fix available6.5 Medium
- red hat .net 6.0 on red hat enterprise linux, cryostat 3, logging subsystem for red hat openshift +52 more +54 moreNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptCVE-2024-11831Fix available5.4 Medium
- red hat jboss data grid 7, jboss enterprise application platform 7, jboss enterprise application platform 8 +2 more +4 moreOrg.jboss.hal:hal-console: wildfly hal console cross-site scriptingCVE-2025-23366Fix available6.5 Medium
- red hat build of keycloak, build of keycloak 26.0, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headersCVE-2024-11734Fix available6.5 Medium
- red hat build of keycloak, build of keycloak 26.0, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variablesCVE-2024-11736Fix available4.9 Medium
- red hat jboss data grid 7, jboss eap xp 5.0 update 2.0, jboss enterprise application platform 7 +4 more +6 moreNarayana: deadlock via multiple join requests sent to lra coordinatorCVE-2024-8447Fix available5.9 Medium
- red hat build of keycloak, jboss enterprise application platform 8, jboss enterprise application platform expansion pack +2 moreKeycloak: cli option for encrypted jgroups ignoredCVE-2024-10973Fix available5.7 Medium
- red hat cryostat 3, cryostat 4 on rhel 9, hawtio hawtio 4.2.0 +12 more +14 moreIo.quarkus.http/quarkus-http-core: quarkus http cookie smugglingCVE-2024-12397Fix available7.4 High
- red hat build of keycloak, jboss enterprise application platform 7, jboss enterprise application platform 8 +1 more +3 moreElytron-oidc-client: oidc authorization code injectionCVE-2024-12369Fix available4.2 Medium
- red hat build of keycloak 24, build of keycloak 24.0.9, build of keycloak 26.0 +4 more +6 moreKeycloak-quarkus-server: keycloak path trasversalCVE-2024-10492Fix available2.7 Low
- red hat build of keycloak 24, build of keycloak 24.0.9, build of keycloak 26.0 +3 more +5 moreOrg.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build processCVE-2024-10451Fix available5.9 Medium
- red hat build of keycloak 24, build of keycloak 24.0.9, build of keycloak 26.0 +4 more +6 moreOrg.keycloak:keycloak-services: keycloak denial of serviceCVE-2024-10270Fix available6.5 Medium
- red hat build of keycloak, build of keycloak 24, build of keycloak 24.0.9 +3 more +5 moreOrg.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerabilityCVE-2024-9666Fix available4.7 Medium
- red hat build of keycloak, fuse 7, jboss data grid 7 +14 more +16 moreWildfly: wildfly vulnerable to cross-site scripting (xss)CVE-2024-10234Fix available6.1 Medium
- red hat jboss data grid 7, jboss enterprise application platform 7, jboss enterprise application platform 8 +1 more +3 moreResteasy-netty4-cdi: resteasy-netty4: resteasy-reactor-netty: http request smuggling leading to client timeouts in resteasy-netty4CVE-2024-9622Fix available5.3 Medium
- red hat migration toolkit for applications 6, migration toolkit for runtimes 1 on rhel 8, build of apache camel for spring boot 3 +21 more +23 moreUndertow: cookie smuggling/spoofingCVE-2023-4639Fix available7.4 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 7.4 for rhel 8, jboss enterprise application platform 7.4 for rhel 9 +4 more +6 moreUndertow: unrestricted request storage leads to memory exhaustionCVE-2023-1973Fix available7.5 High
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +13 more +15 moreKeycloak: vulnerable redirect uri validation results in open redirecCVE-2024-8883Fix available6.1 Medium
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +8 more +10 moreKeycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloakCVE-2024-8698Public exploitFix available7.7 High
- redhat keycloak, red hat build of keycloak, build of keycloak 22 +8 more +10 moreWildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adaptersCVE-2024-7341Fix available7.1 High
- redhat keycloak, red hat build of keycloak, build of keycloak 22 +11 more +13 moreKeycloak: potential bypass of brute force protectionCVE-2024-4629Fix available6.5 Medium
- red hat hawtio 4.0.0 for red hat build of apache camel 4, build of apache camel 3.20.7 for spring boot, build of apache camel 4.4.2 for spring boot +26 more +28 moreUndertow: improper state management in proxy protocol parsing causes information leakageCVE-2024-7885Fix available7.5 High
- red hat openshift serverless, build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +21 more +23 moreUndertow: learningpushhandler can lead to remote memory dos attacksCVE-2024-3653Fix available5.3 Medium
- red hat build of apache camel - hawtio 4, build of apache camel 3.20.7 for spring boot, build of apache camel 4.4.1 for spring boot 3.2 +17 more +19 moreUndertow: response write hangs in case of java 17 tlsv1.3 newsessionticketCVE-2024-5971Fix available7.5 High
- red hat eap 8.0.1, build of apache camel - hawtio 4, build of apache camel 4.4.1 for spring boot 3.2 +11 more +13 moreUndertow: url-encoded request path information can be broken on ajp-listenerCVE-2024-6162Fix available7.5 High
- red hat build of keycloak, jboss enterprise application platform 8, single sign-on 7 +2 moreKeycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitiesCVE-2024-3656Public exploitFix available8.1 High
- red hat build of keycloak, data grid 8, fuse 7 +11 more +13 moreWildfly: no timeout for eap management interface may lead to denial of service (dos)CVE-2024-40294.1 Medium
- jberet, red hat build of keycloak, data grid 8 +11 more +13 moreJberet: jberet-core logging database credentialsCVE-2024-1102Fix available6.5 Medium
- red hat a-mq clients 2, cryostat 2, openshift serverless +9 more +11 moreQuarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.CVE-2023-5675Fix available6.5 Medium
- red hat migration toolkit for applications 6, migration toolkit for applications 7, amq broker 7 +18 more +20 moreKeycloak: xss via assertion consumer service url in saml post-binding flowCVE-2023-6717Fix available6.0 Medium
- red hat migration toolkit for applications 6, migration toolkit for applications 7, amq broker 7 +20 more +22 moreKeycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddosCVE-2024-1249Fix available7.4 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8, jboss enterprise application platform 8.0 for rhel 8 +2 more +4 moreEap: oidc app attempting to access the second tenant, the user should be prompted to logCVE-2023-6236Fix available7.3 High
- red hat jboss enterprise application platform, jboss enterprise application platform 7.1 eus for rhel 7, jboss enterprise application platform 7.3 eus for rhel 7 +7 more +9 moreEap: wildfly-elytron has a ssrf security issueCVE-2024-12337.3 High
- red hat a-mq clients 2, ceq 3.2, cryostat 2 on rhel 8 +22 more +24 moreIo.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni supportCVE-2024-1300Fix available5.4 Medium
- tukaani xz, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreXz: malicious code in distributed sourceCVE-2024-3094Public exploitFix availableEPSS 90.9%10.0 Critical
- red hat a-mq clients 2, ceq 3.2, cryostat 2 on rhel 8 +22 more +24 moreIo.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxCVE-2024-1023Fix available6.5 Medium
- red hat build of apache camel - hawtio 4, build of apache camel 4.4.0 for spring boot, build of apache camel for spring boot 3 +15 more +17 moreXnio: stackoverflowexception when the chain of notifier states becomes problematically bigCVE-2023-5685Fix available7.5 High
- netapp active iq unified manager, oncommand workflow automation, red hat openshift serverless +35 more +37 moreUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolCVE-2024-1635Fix available7.5 High
- redhat undertow, red hat build of quarkus, data grid 8 +12 more +14 moreUndertow: directory traversal vulnerabilityCVE-2024-1459Fix available5.3 Medium
- infinispan, red hat build of apache camel 4 for quarkus 3, build of apache camel for spring boot 4 +13 more +15 moreInfinispan: circular reference on marshalling leads to dosCVE-2023-5236Fix available4.4 Medium
- red hat jboss enterprise application platform, jboss enterprise application platform 7.4 for rhel 8, jboss enterprise application platform 7.4 for rhel 9 +3 more +5 moreWildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actorCVE-2023-4061Fix available6.5 Medium
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty has unbounded pre-allocation in RedisArrayAggregator from RESP array lengthCVE-2026-50011Public exploitFix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty's wrapping plain trust manager silently disables hostname verificationCVE-2026-50010Fix available7.5 High
- Show moreLoading…