Redhat Jboss Enterprise Application Platform vulnerabilities

• red hat build of keycloak, jboss enterprise application platform expansion pack, single sign-on 7 +2 more Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow CVE-2026-18967 6.4 MediumAugust 6, 2026
• red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +7 more +9 more Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers CVE-2026-16102 Fix available 8.1 HighAugust 5, 2026
• red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +7 more +9 more Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher CVE-2026-15573 Fix available 8.1 HighAugust 5, 2026
• red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +5 more +7 more Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers CVE-2026-16093 Fix available 5.4 MediumJuly 17, 2026
• red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +5 more +7 more Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 CVE-2026-15945 Fix available 4.3 MediumJuly 16, 2026
• red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +3 more +5 more Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions CVE-2026-14209 4.3 MediumJune 30, 2026
• apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +8 more +10 more Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory CVE-2026-50632 Fix available 8.1 HighJune 12, 2026
• apache cxf, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +12 more +14 more Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils CVE-2026-49875 Fix available 9.8 CriticalJune 12, 2026
• spring for apache kafka, vmware spring for apache kafka, red hat fuse 7 +2 more +4 more In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization CVE-2026-41731 Fix available 8.1 HighJune 9, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 more Undertow: undertow: request smuggling via malformed http request headers CVE-2026-28369 Fix available 8.7 HighMarch 27, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +20 more +22 more Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator CVE-2026-28367 Fix available 8.7 HighMarch 27, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 more Undertow: undertow: request smuggling via inconsistent header parsing CVE-2026-28368 Fix available 8.7 HighMarch 27, 2026
• red hat build of keycloak 26.4, build of keycloak 26.4.11, jboss enterprise application platform 8 +5 more +7 more Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission CVE-2026-3121 Fix available 6.5 MediumMarch 26, 2026
• red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.13 +7 more +9 more Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation CVE-2026-4874 Fix available 3.1 LowMarch 26, 2026
• red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.12 +5 more +7 more Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak CVE-2026-4366 5.8 MediumMarch 18, 2026
• red hat build of keycloak 26.4, build of keycloak 26.4.10, jboss enterprise application platform 8 +5 more +7 more Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass) CVE-2026-3009 Fix available 8.1 HighMarch 5, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel 4.14.4 for spring boot 3.5.11 +33 more +35 more Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVE-2025-12543 Fix available 9.6 CriticalJanuary 7, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel 4.14.2 for spring boot 3.5.8 +32 more +34 more Undertow: undertow madeyoureset http/2 ddos vulnerability CVE-2025-9784 Public exploitFix available 7.5 HighSeptember 2, 2025
• infinispan, red hat data grid 8.5.4, jboss enterprise application platform 7 +4 more +6 more Infinispan: credential leakage in infinispan cli CVE-2025-5731 5.5 MediumJune 26, 2025
• red hat build of keycloak, data grid 8, fuse 7 +13 more +15 more Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli CVE-2025-23368 Fix available 8.1 HighMarch 4, 2025
• redhat wildfly, red hat build of keycloak, data grid 8 +14 more +16 more Org.wildfly.core:wildfly-server: wildfly improper rbac permission CVE-2025-23367 Fix available 6.5 MediumJanuary 30, 2025
• hibernate hibernate-validator, red hat a-mq clients 2, cryostat 2 +29 more +31 more Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss CVE-2023-1932 Fix available 6.1 MediumNovember 7, 2024
• red hat build of keycloak, fuse 7, jboss data grid 7 +14 more +16 more Wildfly: wildfly vulnerable to cross-site scripting (xss) CVE-2024-10234 Fix available 6.1 MediumOctober 22, 2024
• red hat hawtio 4.0.0 for red hat build of apache camel 4, build of apache camel 3.20.7 for spring boot, build of apache camel 4.4.2 for spring boot +26 more +28 more Undertow: improper state management in proxy protocol parsing causes information leakage CVE-2024-7885 Fix available 7.5 HighAugust 21, 2024
• jberet, red hat build of keycloak, data grid 8 +11 more +13 more Jberet: jberet-core logging database credentials CVE-2024-1102 Fix available 6.5 MediumApril 25, 2024
• netapp active iq unified manager, oncommand workflow automation, red hat openshift serverless +35 more +37 more Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol CVE-2024-1635 Fix available 7.5 HighFebruary 19, 2024
• red hat eap 7.4.14, jboss enterprise application platform 7.4 for rhel 8, jboss enterprise application platform 7.4 for rhel 9 +3 more +5 more Eap-galleon: custom provisioning creates unsecured http-invoker CVE-2023-4503 6.8 MediumFebruary 6, 2024
• red hat eap 7.4.13, jboss enterprise application platform 7.4 for rhel 8, jboss enterprise application platform 7.4 for rhel 9 +2 more +4 more Eap-7: heap exhaustion via deserialization CVE-2023-3171 7.5 HighDecember 27, 2023
• infinispan, red hat data grid 8.4.4, jboss enterprise application platform 6 +3 more +5 more Infinispan: non-admins should not be able to get cache config via rest api CVE-2023-3629 Fix available 4.3 MediumDecember 18, 2023
• infinispan, red hat data grid 8.4.4, jboss enterprise application platform 6 +3 more +5 more Infispan: rest bulk ops don't check permissions CVE-2023-3628 Fix available 6.5 MediumDecember 18, 2023
• 9bis kitty, apache sshd, sshj +68 more +70 more Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin CVE-2023-48795 Public exploitFix available EPSS 93.5% 5.9 MediumDecember 18, 2023
• redhat undertow, red hat build of quarkus, data grid 8 +12 more +14 more Undertow: ajp request closes connection exceeding maxrequestsize CVE-2023-5379 Fix available 7.5 HighDecember 12, 2023
• red hat jboss enterprise application platform, jboss enterprise application platform 7.4 for rhel 8, jboss enterprise application platform 7.4 for rhel 9 +3 more +5 more Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor CVE-2023-4061 Fix available 6.5 MediumNovember 8, 2023
• redhat undertow, red hat build of quarkus, data grid 8 +25 more +27 more Undertow: outofmemoryerror due to @multipartconfig handling CVE-2023-3223 Fix available 7.5 HighSeptember 27, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• redhat undertow, netapp oncommand workflow automation, red hat eap 7.4.10 release +31 more +33 more Undertow: infinite loop in sslconduit during close CVE-2023-1108 Fix available 7.5 HighApril 7, 2023
• red hat undertow, redhat build of quarkus, integration camel for spring boot +7 more +9 more Undertow client not checking server identity presented by server certificate in https connections CVE-2022-4492 Fix available 7.5 HighFebruary 23, 2023
• redhat.com wildfly-elytron, redhat jboss enterprise application platform, wildfly elytron +2 more Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator CVE-2022-3143 Fix available 7.4 HighJanuary 11, 2023
• red hat wildfly, redhat amq, amq online +5 more +7 more WildFly vulnerable to Insecure Default Initialization of Resource CVE-2022-1278 Fix available 7.5 HighSeptember 13, 2022
• red hat undertow, netapp active iq unified manager, cloud secure agent +6 more +8 more A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the... CVE-2022-2764 Fix available 4.9 MediumSeptember 1, 2022
• red hat undertow, netapp active iq unified manager, cloud secure agent +7 more +9 more A flaw was found in Undertow. A potential security issue in flow control handling by the browser... CVE-2022-1259 7.5 HighAugust 31, 2022
• red hat undertow, netapp cloud secure agent, oncommand insight +3 more +5 more Undertow vulnerable to Denial of Service (DoS) attacks CVE-2021-3859 Fix available 7.5 HighJuly 15, 2022
• red hat undertow, redhat fuse, integration camel k +4 more +6 more Undertow vulnerable to memory exhaustion due to buffer leak CVE-2021-3690 Fix available 7.5 HighJuly 15, 2022
• red hat undertow, netapp active iq unified manager, oncommand insight +5 more +7 more undertow Race Condition vulnerability CVE-2021-3597 Fix available 5.9 MediumMay 24, 2022
• red hat undertow, netapp active iq unified manager, oncommand insight +5 more +7 more Undertow Uncontrolled Resource Consumption CVE-2021-3629 Fix available 5.9 MediumMay 24, 2022
• red hat wildfly, redhat jboss enterprise application platform, single sign-on +1 more +3 more Wildfly-Core user account mismanagement CVE-2021-3717 Fix available 7.8 HighMay 24, 2022
• red hat wildfly, redhat jboss enterprise application platform, openstack platform +2 more This is a concurrency issue that can result in the wrong caller principal being returned from the... CVE-2022-0866 Fix available 5.3 MediumMay 10, 2022
• redhat descision manager, jboss enterprise application platform, jboss enterprise application platform expansion pack +2 more +4 more A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss... CVE-2022-0853 Public exploit 7.5 HighMarch 11, 2022
• redhat jboss enterprise application platform The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A... CVE-2021-20318 7.2 HighDecember 23, 2021
• apache log4j, apache software foundation log4j 1.x, fedoraproject fedora +44 more +46 more Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVE-2021-4104 Public exploitFix available EPSS 80.6% 7.5 HighDecember 14, 2021
• Show olderLoading…