This security advisory for Red Hat JBoss Enterprise Application Platform 8.1.0 addresses three main vulnerabilities: CVE-2025-58056, a request smuggling vulnerability in netty-codec-http and netty-codec-http2 caused by incorrect parsing of chunk extensions; CVE-2025-48913, a code execution vulnerability in Apache CXF JMS; and CVE-2025-55163, a HTTP/2 DDoS vulnerability in Netty. The update includes upgrades to Netty (to version 4.1.127.Final) and Apache CXF (to 4.0.9.redhat-00002) among other component updates. These fixes mitigate the identified security issues. The vendor advisory classifies the impact as Important and provides instructions for applying the update.

The vulnerabilities include request smuggling in HTTP and HTTP/2 protocols that could allow attackers to interfere with request processing, and a JMS code execution vulnerability in Apache CXF that could allow remote code execution. These issues could lead to unauthorized actions or denial of service. The vendor rates the overall security impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

An official security update is available from Red Hat for JBoss Enterprise Application Platform 8.1.0 that addresses these vulnerabilities by upgrading affected components. Users should apply this update after ensuring all previous relevant errata are applied and backing up their systems. The vendor provides detailed instructions for applying the update. No additional mitigation steps are indicated beyond applying the official patch.