This security advisory from Red Hat addresses several vulnerabilities in the Netty components used by Red Hat JBoss Enterprise Application Platform 8.1. The vulnerabilities include CVE-2026-44249 (IPv6 subnet rule bypass due to incorrect masking operation), CVE-2026-45416 (denial of service from eager buffer allocation in TLS handshake), CVE-2026-45674 (information disclosure and data manipulation due to improper CNAME record validation), CVE-2026-47691 (insufficient bailiwick validation for NS records), and CVE-2026-50010 (hostname verification bypass from improper trust manager handling). The update upgrades Netty from version 4.1.133.Final-redhat-00001 to 4.1.135.Final-redhat-00001 and is part of the Red Hat JBoss EAP 8.1.7 release. Users are advised to apply this update after ensuring all prior errata are applied and backing up their systems.

The vulnerabilities fixed in this update could allow attackers to bypass IPv6 subnet rules, cause denial of service during TLS handshakes, disclose information or manipulate data via DNS CNAME record validation flaws, bypass hostname verification, and exploit insufficient DNS bailiwick validation. These issues collectively could impact the security and reliability of applications running on Red Hat JBoss Enterprise Application Platform 8.1. The advisory rates the overall security impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

A security update is available for Red Hat JBoss Enterprise Application Platform 8.1.7 that addresses these vulnerabilities by upgrading the Netty library to a fixed version. Users should apply this update promptly after ensuring all previously released errata are applied and backing up their existing installations, including applications, configuration files, and databases. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are indicated beyond applying the official patch.