This advisory covers security fixes in Red Hat JBoss Enterprise Application Platform 7.4.24, which replaces 7.4.23. Key vulnerabilities fixed include CVE-2024-3884 (OutOfMemory in undertow when parsing application/x-www-form-urlencoded data), CVE-2025-12543 (Undertow HTTP server failing to reject malformed host headers leading to potential cache poisoning and SSRF), CVE-2025-48913 (CXF JMS code execution vulnerability), CVE-2025-55163 and CVE-2025-9784 (HTTP/2 DDoS vulnerabilities in netty and undertow), CVE-2025-4949 (XXE in Eclipse JGit), and CVE-2026-0603 (information disclosure and data deletion via second-order SQL injection in Hibernate). The update also addresses other vulnerabilities such as a stack overflow in jackson-core and protobuf. These fixes mitigate risks related to denial of service, remote code execution, server-side request forgery, XML external entity attacks, and SQL injection.

The vulnerabilities fixed in this update can lead to denial of service conditions (OutOfMemory, HTTP/2 DDoS), remote code execution (CXF JMS), cache poisoning and SSRF (malformed host headers), XML external entity attacks (XXE in JGit), and information disclosure or data deletion (Hibernate SQL injection). Exploitation of these flaws could compromise the confidentiality, integrity, and availability of affected systems running vulnerable versions of Red Hat JBoss Enterprise Application Platform 7.4 prior to 7.4.24.

A security update is available in Red Hat JBoss Enterprise Application Platform version 7.4.24 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata are applied and backing up their systems, including applications and configurations. No additional vendor-stated mitigations or workarounds are indicated. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258 for detailed guidance.