Red Hat JBoss Enterprise Application Platform 7.3 and 8.0, platforms for Java applications based on the WildFly runtime, contain multiple security vulnerabilities. Notably, CVE-2024-4109 involves information leakage via HTTP/2 request header reuse in the Undertow component, and CVE-2024-51127 allows arbitrary file overwrite or sensitive information access in the hornetq-core-client component. Red Hat has released security updates 7.3.15 and 8.0.5 that include these fixes along with other enhancements and bug fixes. The advisories indicate a range of severity levels, with the 7.3 update rated critical and the 8.0 update rated low impact. The vendor advisory confirms patch availability and provides detailed remediation instructions.

The vulnerabilities could lead to information leakage and unauthorized file overwrite or access, potentially compromising confidentiality and integrity of affected systems running Red Hat JBoss Enterprise Application Platform 7.3 or 8.0. The 7.3 update is rated critical, indicating a high risk of exploitation impact, while the 8.0 update is rated low impact. No known exploits in the wild have been reported at this time.

Official security updates 7.3.15 for JBoss EAP 7.3 and 8.0.5 for JBoss EAP 8.0 are available and should be applied promptly. Before applying these updates, ensure all previous errata are applied and back up existing installations, including applications, configuration files, and databases. Follow Red Hat's documented update procedures as detailed in their advisories and knowledge base articles. No additional vendor-recommended mitigations are indicated beyond applying these patches.