This advisory covers security fixes in Red Hat JBoss Enterprise Application Platform 8.1.6, including CVE-2026-1605, a denial of service vulnerability in the jetty-server component due to unreleased JDK Inflater resources when processing compressed HTTP requests with Content-Encoding: gzip. This resource leak can cause server unavailability. Additionally, three request smuggling vulnerabilities in the undertow-core component (CVE-2026-28367, CVE-2026-28368, CVE-2026-28369) are addressed, which involve malformed or inconsistent HTTP header parsing that could allow request smuggling attacks. Red Hat has issued an important security update with fixes for these issues.

Exploitation of CVE-2026-1605 can lead to denial of service by exhausting server resources through unreleased JDK Inflater instances. The request smuggling vulnerabilities in Undertow may allow attackers to manipulate HTTP requests, potentially bypassing security controls or causing unexpected behavior. These vulnerabilities impact availability and request integrity but do not affect confidentiality or integrity of data directly. No known exploits in the wild have been reported at this time.

A security update is available in Red Hat JBoss Enterprise Application Platform 8.1.6 that addresses these vulnerabilities. Users should apply this official patch to remediate the issues. Before updating, ensure all prior errata are applied and back up existing installations. No vendor advisory indicates that no action is required or that mitigations exist other than applying the update.