This advisory covers several vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3.15, including CVE-2024-4109 (information leakage via HTTP/2 request header reuse in undertow), CVE-2024-7885 (improper state management in Proxy Protocol parsing causing information leakage in undertow), CVE-2024-27316 (HTTP/2 CONTINUATION frames denial of service in httpd), CVE-2024-51127 (arbitrary file overwrite or sensitive information access in hornetq-core-client), and CVE-2025-48734 (Apache Commons BeanUtils PropertyUtilsBean not suppressing an enum's declaredClass property by default). These vulnerabilities impact the Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server and related components. The update to version 7.3.15 addresses these issues with fixes and upgrades to affected components.

The vulnerabilities collectively allow for information leakage, denial of service, and arbitrary file overwrite or unauthorized access to sensitive information within affected Red Hat JBoss Enterprise Application Platform 7.3.x deployments. These issues could lead to exposure of sensitive data, disruption of service, or unauthorized modification of files, potentially impacting confidentiality, integrity, and availability of affected systems.

A security update to Red Hat JBoss Enterprise Application Platform 7.3.15 is available and should be applied. This update replaces version 7.3.14 and includes fixes for all listed vulnerabilities. Before applying the update, ensure all previously released errata are applied and back up existing installations, including applications, configuration files, and databases. Follow Red Hat's official guidance for applying the update as detailed in their advisory and documentation. Patch status is confirmed as available and official.