This advisory covers security fixes in Red Hat JBoss Enterprise Application Platform 7.4.22, which updates components such as io.netty/netty-handler, io.netty/netty, netty-common, and org.wildfly.core/wildfly-server. The key vulnerabilities addressed include CVE-2024-47535 and CVE-2025-25193, both denial of service vulnerabilities affecting Windows applications using Netty, CVE-2025-24970 where SslHandler fails to correctly validate packets potentially causing native crashes with native SSLEngine, and CVE-2025-23367 involving improper RBAC permissions in Wildfly. These fixes mitigate risks of service disruption and unauthorized permission escalation. The update is intended for Red Hat JBoss EAP 7.4 on RHEL 8 and replaces the prior 7.4.21 release.

The vulnerabilities fixed in this update can cause denial of service conditions on Windows applications using Netty, potentially leading to application crashes or service interruptions. The improper RBAC permission vulnerability could allow unauthorized users to gain elevated access within Wildfly, impacting application security. The SslHandler validation flaw may cause native crashes when using native SSLEngine, affecting application stability. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update in version 7.4.22 of JBoss Enterprise Application Platform that addresses these vulnerabilities. Users should apply this update after confirming all previous relevant errata are installed and backing up their systems. Detailed update instructions are available from Red Hat's official documentation. Since this is not a cloud service, remediation requires manual patching by the user. Patch status is confirmed as fixed in this release.