Skip to main content
CVE-2024-28752VulnerabilityPublished Updated

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.3 Security update

Affects Red HatSource GCVE Database

0

Mentioned vulnerabilities

Not known to be exploited : upgrade Red Hat to 8.0.3 soon.

Data as of 26 Oct 2026, 10:12 UTC

Severity
High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS
2.9% chance of exploitation in 30 days – higher than 86% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 8.0.3

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 15 Aug 2024

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

What to do

Upgrade Red Hat to 8.0.3.

Affected software

ProductAffectedFixed in
Red Hat Product Security Red HatAffected
  • >=8.0.0 <8.0.3
Fixed in
  • 8.0.3

AI-suggested

A security update to Red Hat JBoss Enterprise Application Platform 8.0.3 is available and should be applied to affected systems. This update replaces version 8.0.2 and includes fixes for the listed vulnerabilities. Before applying the update, ensure all previously released errata are applied and back up existing installations, including applications and configurations. Follow Red Hat's official guidance for applying the update as detailed in their advisory. No additional mitigation is required beyond applying this official update.

Description

Red Hat JBoss Enterprise Application Platform 8.0.3 addresses multiple important security vulnerabilities affecting the 8.0 series on RHEL 9. These include server-side request forgery (SSRF) in Apache CXF, timing attacks and infinite loops in the BouncyCastle cryptographic library, resource allocation issues in Netty HTTP codec, and denial of service via crafted elliptic curve certificates. The update replaces version 8.0.2 and includes bug fixes and enhancements alongside security patches.

References

Community reviews

Loading reviews…