This advisory covers a security update for Red Hat JBoss Enterprise Application Platform 7.4.24, which addresses several vulnerabilities across its components. Notable fixes include CVE-2024-3884 (OutOfMemory in undertow when parsing application/x-www-form-urlencoded data), CVE-2025-12543 (Undertow HTTP server failing to reject malformed host headers leading to potential cache poisoning and SSRF), CVE-2025-48913 (CXF JMS code execution vulnerability), CVE-2025-55163 and CVE-2025-9784 (HTTP/2 DDoS vulnerabilities in Netty and Undertow), CVE-2025-4949 (XXE in Eclipse JGit), and CVE-2026-0603 (Hibernate second-order SQL injection causing information disclosure and data deletion). The update is intended to fix these issues in the 7.4.z branch of the platform. Red Hat rates the security impact as Important and provides the update as a replacement for version 7.4.23.

The vulnerabilities fixed in this update can lead to denial of service via OutOfMemory or HTTP/2 DDoS attacks, remote code execution through JMS, information disclosure and data deletion via SQL injection, server-side request forgery and cache poisoning through malformed host headers, and XML external entity (XXE) attacks. These impacts affect the confidentiality, integrity, and availability of systems running affected versions of Red Hat JBoss Enterprise Application Platform 7.4.

A security update to Red Hat JBoss Enterprise Application Platform 7.4.24 is available and should be applied to remediate these vulnerabilities. Before applying the update, ensure all previously released errata are applied and back up existing installations including applications and configurations. Follow Red Hat's official guidance for applying the update at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying this update.