Skip to contentRed Hat Jboss Enterprise Application Platform vulnerabilities
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +13 more +15 moreKeycloak: vulnerable redirect uri validation results in open redirecCVE-2024-8883Fix available6.1 Medium
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +8 more +10 moreKeycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloakCVE-2024-8698Public exploitFix available7.7 High
- redhat keycloak, red hat build of keycloak, build of keycloak 22 +8 more +10 moreWildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adaptersCVE-2024-7341Fix available7.1 High
- redhat keycloak, red hat build of keycloak, build of keycloak 22 +11 more +13 moreKeycloak: potential bypass of brute force protectionCVE-2024-4629Fix available6.5 Medium
- red hat hawtio 4.0.0 for red hat build of apache camel 4, build of apache camel 3.20.7 for spring boot, build of apache camel 4.4.2 for spring boot +26 more +28 moreUndertow: improper state management in proxy protocol parsing causes information leakageCVE-2024-7885Fix available7.5 High
- red hat openshift serverless, build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +21 more +23 moreUndertow: learningpushhandler can lead to remote memory dos attacksCVE-2024-3653Fix available5.3 Medium
- red hat build of apache camel - hawtio 4, build of apache camel 3.20.7 for spring boot, build of apache camel 4.4.1 for spring boot 3.2 +17 more +19 moreUndertow: response write hangs in case of java 17 tlsv1.3 newsessionticketCVE-2024-5971Fix available7.5 High
- red hat eap 8.0.1, build of apache camel - hawtio 4, build of apache camel 4.4.1 for spring boot 3.2 +11 more +13 moreUndertow: url-encoded request path information can be broken on ajp-listenerCVE-2024-6162Fix available7.5 High
- red hat build of keycloak, jboss enterprise application platform 8, single sign-on 7 +2 moreKeycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitiesCVE-2024-3656Public exploitFix available8.1 High
- red hat build of keycloak, data grid 8, fuse 7 +11 more +13 moreWildfly: no timeout for eap management interface may lead to denial of service (dos)CVE-2024-40294.1 Medium
- jberet, red hat build of keycloak, data grid 8 +11 more +13 moreJberet: jberet-core logging database credentialsCVE-2024-1102Fix available6.5 Medium
- red hat a-mq clients 2, cryostat 2, openshift serverless +9 more +11 moreQuarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.CVE-2023-5675Fix available6.5 Medium
- red hat migration toolkit for applications 6, migration toolkit for applications 7, amq broker 7 +18 more +20 moreKeycloak: xss via assertion consumer service url in saml post-binding flowCVE-2023-6717Fix available6.0 Medium
- red hat migration toolkit for applications 6, migration toolkit for applications 7, amq broker 7 +20 more +22 moreKeycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddosCVE-2024-1249Fix available7.4 High
- redhat keycloak, red hat migration toolkit for runtimes 1 on rhel 8, mta-6.2-rhel-9 +26 more +28 moreKeycloak: path transversal in redirection validationCVE-2024-1132Fix available8.1 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8, jboss enterprise application platform 8.0 for rhel 8 +2 more +4 moreEap: oidc app attempting to access the second tenant, the user should be prompted to logCVE-2023-6236Fix available7.3 High
- red hat jboss enterprise application platform, jboss enterprise application platform 7.1 eus for rhel 7, jboss enterprise application platform 7.3 eus for rhel 7 +7 more +9 moreEap: wildfly-elytron has a ssrf security issueCVE-2024-12337.3 High
- red hat a-mq clients 2, ceq 3.2, cryostat 2 on rhel 8 +22 more +24 moreIo.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni supportCVE-2024-1300Fix available5.4 Medium
- tukaani xz, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreXz: malicious code in distributed sourceCVE-2024-3094Public exploitFix availableEPSS 90.9%10.0 Critical
- red hat a-mq clients 2, ceq 3.2, cryostat 2 on rhel 8 +22 more +24 moreIo.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxCVE-2024-1023Fix available6.5 Medium
- red hat build of apache camel - hawtio 4, build of apache camel 4.4.0 for spring boot, build of apache camel for spring boot 3 +15 more +17 moreXnio: stackoverflowexception when the chain of notifier states becomes problematically bigCVE-2023-5685Fix available7.5 High
- netapp active iq unified manager, oncommand workflow automation, red hat openshift serverless +35 more +37 moreUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolCVE-2024-1635Fix available7.5 High
- redhat undertow, red hat build of quarkus, data grid 8 +12 more +14 moreUndertow: directory traversal vulnerabilityCVE-2024-1459Fix available5.3 Medium
- red hat eap 7.4.14, jboss enterprise application platform 7.4 for rhel 8, jboss enterprise application platform 7.4 for rhel 9 +3 more +5 moreEap-galleon: custom provisioning creates unsecured http-invokerCVE-2023-45036.8 Medium
- red hat eap 7.4.13, jboss enterprise application platform 7.4 for rhel 8, jboss enterprise application platform 7.4 for rhel 9 +2 more +4 moreEap-7: heap exhaustion via deserializationCVE-2023-31717.5 High
- redhat keycloak, red hat migration toolkit for applications 6, migration toolkit for applications 7 +21 more +23 moreKeycloak: redirect_uri validation bypassCVE-2023-6291Fix available7.1 High
- infinispan, red hat build of apache camel 4 for quarkus 3, build of apache camel for spring boot 4 +13 more +15 moreInfinispan: circular reference on marshalling leads to dosCVE-2023-5236Fix available4.4 Medium
- infinispan, red hat data grid 8.4.4, jboss enterprise application platform 6 +3 more +5 moreInfinispan: non-admins should not be able to get cache config via rest apiCVE-2023-3629Fix available4.3 Medium
- infinispan, red hat data grid 8.4.4, jboss enterprise application platform 6 +3 more +5 moreInfispan: rest bulk ops don't check permissionsCVE-2023-3628Fix available6.5 Medium
- redhat undertow, red hat build of quarkus, data grid 8 +12 more +14 moreUndertow: ajp request closes connection exceeding maxrequestsizeCVE-2023-5379Fix available7.5 High
- red hat jboss enterprise application platform, jboss enterprise application platform 7.4 for rhel 8, jboss enterprise application platform 7.4 for rhel 9 +3 more +5 moreWildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actorCVE-2023-4061Fix available6.5 Medium
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty has unbounded pre-allocation in RedisArrayAggregator from RESP array lengthCVE-2026-50011Public exploitFix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty's wrapping plain trust manager silently disables hostname verificationCVE-2026-50010Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +24 more +26 moreNetty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory ExhaustionCVE-2026-48059Fix available8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +24 more +26 morenetty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionCVE-2026-48043Fix available5.3 Medium
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorCVE-2026-48006Fix available8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty has Insufficient Bailiwick Validation for NS RecordsCVE-2026-47691Fix available8.7 High
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +8 more +10 moreNetty: SCTP reassembly nests buffers without boundCVE-2026-46340Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME RecordsCVE-2026-45674Public exploitFix available8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty: SNI handler pre-allocates up to 16 MiB from nine attacker bytesCVE-2026-45416Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +23 more +25 moreNetty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV lengthCVE-2026-44893Fix available7.5 High
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty has Unbounded Direct Memory Consumption in its RedisDecoderCVE-2026-44890Fix available7.5 High
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested ArraysCVE-2026-44250Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingCVE-2026-44249Fix available8.1 High
- netty, io.netty netty-codec-mqtt, red hat amq broker 7.13.6 +8 more +10 moreNetty: Resource exhaustion in MqttDecoderCVE-2026-44248Fix available5.3 Medium
- netty, io.netty netty-codec-http, netty-codec-http2 +37 more +39 moreNetty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoSCVE-2026-42587Fix available7.5 High
- netty, io.netty netty-codec-http, red hat cryostat 4 on rhel 9 +33 more +35 moreNetty: HttpClientCodec response desynchronizationCVE-2026-42584Fix available7.3 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +32 more +34 moreNetty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling SanitizationCVE-2026-42581Fix available5.8 Medium
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)CVE-2026-42579Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +32 more +34 moreNetty: HTTP Header Injection via HttpProxyHandler Disabled ValidationCVE-2026-42578Fix available2.9 Low
- Show moreLoading…