This security advisory covers several vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4. Key issues include denial of service vulnerabilities in the Netty framework (CVE-2024-47535, CVE-2025-25193), a native crash vulnerability due to improper SSL packet validation in io.netty/netty-handler (CVE-2025-24970), improper RBAC permissions in WildFly server (CVE-2025-23367), and a vulnerability in hornetq-core-client allowing arbitrary file overwrite or sensitive information access (CVE-2024-51127). The advisory references multiple CVEs and provides a security update to remediate these flaws. No CVSS scores are provided in the advisory, but the issues are rated as having an important security impact by Red Hat.

The vulnerabilities can lead to denial of service conditions on Windows applications using Netty, native crashes when using native SSLEngine due to improper SSL packet validation, unauthorized access due to improper RBAC permissions in WildFly, and potential arbitrary file overwrite or sensitive information disclosure via HornetQ core client. These issues could disrupt application availability, compromise security controls, and expose sensitive data.

Red Hat has released an important security update for JBoss Enterprise Application Platform 7.4.21 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata are applied and after backing up their installations and configurations. Detailed update instructions are available from Red Hat's official documentation. Patch status is confirmed as available via this update.