This advisory covers security fixes in Red Hat JBoss Enterprise Application Platform 8.0.9 for three vulnerabilities: CVE-2025-55163, a Netty HTTP/2 DDoS vulnerability; CVE-2025-58056, a Netty HTTP request smuggling vulnerability due to incorrect parsing of chunk extensions; and CVE-2025-48913, a CXF JMS code execution vulnerability. The update upgrades Netty to version 4.1.127.Final and Apache CXF to 4.0.9.redhat-00002, among other component upgrades, to address these issues. Red Hat rates the security impact as Important and provides detailed errata and upgrade instructions. No known exploits in the wild have been reported at the time of the advisory.

The vulnerabilities addressed include a denial-of-service vector via HTTP/2 in Netty, an HTTP request smuggling vulnerability in Netty's HTTP codec, and a code execution vulnerability in Apache CXF JMS. These could allow attackers to disrupt service or execute arbitrary code within affected environments. The advisory rates the overall impact as Important, indicating significant security concerns that could affect confidentiality, integrity, or availability of affected systems.

A security update for Red Hat JBoss Enterprise Application Platform 8.0.9 is available and should be applied. The update includes upgraded versions of Netty and Apache CXF that fix the reported vulnerabilities. Before applying the update, ensure all previously released errata are applied and back up all relevant data and configurations. Follow Red Hat's official update instructions at https://access.redhat.com/articles/11258. No indication of 'no action required' or 'already mitigated' is present; applying the update is the recommended remediation.