This security advisory covers a set of vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.1.7 related to the Netty library. The vulnerabilities include CVE-2026-44249 (IPv6 subnet rule bypass due to incorrect masking), CVE-2026-45416 (denial of service from eager buffer allocation in TLS handshake), CVE-2026-45674 (information disclosure and data manipulation due to improper CNAME record validation), CVE-2026-47691 (insufficient bailiwick validation for NS records), and CVE-2026-50010 (hostname verification bypass from improper trust manager handling). These issues affect the netty-handler and netty-resolver-dns components and are addressed by upgrading Netty from version 4.1.133.Final-redhat-00001 to 4.1.135.Final-redhat-00001 in the platform. The advisory recommends applying the update after ensuring all previous errata are applied and backing up existing installations.

The vulnerabilities collectively could allow attackers to cause denial of service conditions, bypass hostname verification, manipulate DNS-related data, and bypass IPv6 subnet rules. These impacts may compromise the security and reliability of applications running on the affected platform. The advisory rates the overall security impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

An official security update is available for Red Hat JBoss Enterprise Application Platform 8.1.7 that addresses these vulnerabilities by upgrading the Netty library to a fixed version. Users should apply this update after ensuring all previously released errata are installed and backing up their systems, including applications and configurations. Detailed update instructions are provided by Red Hat. No additional mitigations are specified beyond applying the official patch.