This security advisory for Red Hat JBoss Enterprise Application Platform 8.0.9 addresses three vulnerabilities: CVE-2025-55163, a Netty HTTP/2 DDoS vulnerability known as MadeYouReset; CVE-2025-58056, a Netty HTTP request smuggling vulnerability caused by incorrect parsing of chunk extensions; and CVE-2025-48913, a code execution vulnerability in Apache CXF JMS. The update upgrades Netty to version 4.1.127.Final and Apache CXF to 4.0.9.redhat-00002, among other component updates, to fix these issues. The advisory rates the security impact as Important (high severity) and provides detailed instructions for applying the update. No known exploits in the wild have been reported at this time.

The vulnerabilities impact critical components of the Red Hat JBoss Enterprise Application Platform 8.0, potentially allowing denial of service via HTTP/2 DDoS attacks, HTTP request smuggling attacks, and remote code execution through the CXF JMS component. Successful exploitation could compromise the availability and security of applications running on the platform. The advisory classifies the impact as Important, indicating a high severity level.

An official security update for Red Hat JBoss Enterprise Application Platform 8.0.9 is available and should be applied to affected systems. The update includes upgraded versions of Netty and Apache CXF that address the vulnerabilities. Before applying the update, ensure all previous errata are applied and back up existing installations, including applications and configurations. Follow Red Hat's published guidance for applying the update: https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.