This advisory addresses two security vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.1.13 on RHEL 7. The first vulnerability (CVE-2025-52999) involves a potential StackoverflowError in the jackson-core library, which could cause application instability or crashes. The second vulnerability (CVE-2025-55163) is an HTTP/2 Denial of Service (DDoS) vulnerability in the netty-codec-http2 component, known as the 'MadeYouReset' vulnerability, which could be exploited to disrupt service availability. The update to version 7.1.13 includes patches for these issues, upgrading undertow and wildfly-core components as part of the fix. The Red Hat advisory rates the update as important, with the overall severity assessed as critical in this context.

Exploitation of CVE-2025-52999 could lead to application crashes due to stack overflow errors in jackson-core, potentially affecting application stability. CVE-2025-55163 could allow attackers to perform HTTP/2-based denial-of-service attacks, impacting service availability. Both vulnerabilities pose significant risks to the reliability and availability of applications running on the affected platform.

A security update to Red Hat JBoss Enterprise Application Platform 7.1.13 is available and should be applied to remediate these vulnerabilities. Before applying the update, ensure all previously released errata relevant to the system are installed and back up all applications, configuration files, and databases. Follow Red Hat's official guidance for applying the update as detailed in their advisory (RHSA-2026:0742). No additional mitigation actions are specified beyond applying this update.