Skip to main content
CVE-2026-44249VulnerabilityPublished Updated

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.7 security update

Affects Red Hat nettySource GCVE Database

0
Compare

Mentioned vulnerabilities

Not known to be exploited.

Data as of 1 Nov 2026, 11:02 UTC

Severity
High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS
0.9% chance of exploitation in 30 days – higher than 62% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 3 Aug 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 1 Nov 2026.

What to do

Affected software

ProductAffectedFixed in
Ubuntu 26.10nettypkg:deb/ubuntu/netty?arch=source&distro=stonkingOther threatsAffected
  • =1:4.1.48-16
  • =1:4.1.48-16ubuntu1
Fixed in–
Ubuntu Pro 26.04 LTSnettypkg:deb/ubuntu/netty?arch=source&distro=esm-apps/resoluteOther threatsAffected
  • 1:4.1.48-10 – 1:4.1.48-16ubuntu0.1~esm2
7 affected builds		Fixed in–
Ubuntu 25.10nettypkg:deb/ubuntu/netty?arch=source&distro=questingOther threatsAffected
  • =1:4.1.48-10
  • =1:4.1.48-10ubuntu0.25.10.1
  • =1:4.1.48-10ubuntu0.25.10.2
Fixed in–
Ubuntu Pro 24.04 LTSnettypkg:deb/ubuntu/netty?arch=source&distro=esm-apps/nobleOther threatsAffected
  • 1:4.1.48-7 – 1:4.1.48-9ubuntu0.2+esm2
11 affected builds		Fixed in–
Ubuntu Pro 22.04 LTSnettypkg:deb/ubuntu/netty?arch=source&distro=esm-apps/jammyOther threatsAffected
  • 1:4.1.48-4 – 1:4.1.48-4+deb11u2ubuntu0.2+esm1
10 affected builds		Fixed in–
Ubuntu Pro 20.04 LTSnettypkg:deb/ubuntu/netty?arch=source&distro=esm-apps/focalOther threatsAffected
  • 1:4.1.33-1 – 1:4.1.45-1ubuntu0.1~esm7
10 affected builds		Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A security update is available for Red Hat JBoss Enterprise Application Platform 8.1.7 that addresses these vulnerabilities by upgrading the Netty library to a fixed version. Users should apply this update promptly after ensuring all previously released errata are applied and backing up their existing installations, including applications, configuration files, and databases. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are indicated beyond applying the official patch.

Description

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is an update for Red Hat JBoss Enterprise Application Platform 8.1. See Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416) * netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674) * netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010) * netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) * netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

Community reviews

Loading reviews…