Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.7.1 XP 6.0.5.1 release
A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1.7.1, XP 6.0.5.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Security Fix(es): * memory exhaustion in io.netty:netty-codec-haproxy (CVE-2026-48059) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-47691) * DDoS in io.netty:netty-codec-http2 (CVE-2026-50560) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-50011) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44250) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44890) * IPv6 subnet filter bypass in io.netty:netty-handler (CVE-2026-44249) * request smuggling in io.netty:netty-codec-http (CVE-2026-50020) * memory leak in io.netty:netty-codec-haproxy (CVE-2026-44893) * TLS hostname verification accidentally disabled in io.netty:netty-handler (CVE-2026-50010) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45673) * excessive memory usage from SNIHandler in io.netty:netty-handler (CVE-2026-45416) * file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue (CVE-2026-45536) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45674) * memory exhaustion in io.netty:netty-transport-sctp (CVE-2026-46340) * denial of service in io.netty:netty-codec-http2 (CVE-2026-47244) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-48006) * memory exhaustion in io.netty:netty-codec-http2 (CVE-2026-48043) * netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
This security advisory from Red Hat addresses multiple vulnerabilities in the Netty components used by Red Hat JBoss Enterprise Application Platform 8.1.7.1 and XP 6.0.5.1. The vulnerabilities include memory exhaustion and denial of service issues in netty-codec-haproxy, netty-codec-redis, netty-codec-http2, and netty-transport-sctp; DNS cache poisoning in netty-resolver-dns; request smuggling in netty-codec-http; IPv6 subnet filter bypass and TLS hostname verification bypass in netty-handler; file descriptor leaks in netty-transport-native-epoll and netty-transport-native-kqueue; and other resource leaks and improper validation issues. The advisory references 19 CVEs, including CVE-2026-42587 which describes a denial of service via unbounded memory allocation in HTTP content decompression. The update upgrades Netty from version 4.1.133.Final-redhat-00001 to 4.1.135.Final-redhat-00001 to address these issues.
Potential Impact
The vulnerabilities collectively could allow attackers to cause denial of service conditions through memory exhaustion, resource leaks, and request smuggling, potentially disrupting application availability. DNS cache poisoning vulnerabilities could lead to incorrect DNS resolutions, impacting data integrity and confidentiality. The TLS hostname verification bypass could allow man-in-the-middle attacks by disabling proper certificate validation. File descriptor leaks and other resource mismanagement could degrade system performance or stability. These issues are rated as having an important security impact by Red Hat.
Mitigation Recommendations
Red Hat has released an official security update that addresses all listed vulnerabilities by upgrading the Netty library to version 4.1.135.Final-redhat-00001. Users of Red Hat JBoss Enterprise Application Platform 8.1.7.1 and XP 6.0.5.1 should apply this update promptly. Before applying the update, ensure all previously released errata are applied and back up existing installations, including applications, configuration files, and databases. No additional mitigation steps are indicated beyond applying the official update.
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.7.1 XP 6.0.5.1 release
Description
A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1.7.1, XP 6.0.5.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Security Fix(es): * memory exhaustion in io.netty:netty-codec-haproxy (CVE-2026-48059) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-47691) * DDoS in io.netty:netty-codec-http2 (CVE-2026-50560) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-50011) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44250) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44890) * IPv6 subnet filter bypass in io.netty:netty-handler (CVE-2026-44249) * request smuggling in io.netty:netty-codec-http (CVE-2026-50020) * memory leak in io.netty:netty-codec-haproxy (CVE-2026-44893) * TLS hostname verification accidentally disabled in io.netty:netty-handler (CVE-2026-50010) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45673) * excessive memory usage from SNIHandler in io.netty:netty-handler (CVE-2026-45416) * file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue (CVE-2026-45536) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45674) * memory exhaustion in io.netty:netty-transport-sctp (CVE-2026-46340) * denial of service in io.netty:netty-codec-http2 (CVE-2026-47244) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-48006) * memory exhaustion in io.netty:netty-codec-http2 (CVE-2026-48043) * netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This security advisory from Red Hat addresses multiple vulnerabilities in the Netty components used by Red Hat JBoss Enterprise Application Platform 8.1.7.1 and XP 6.0.5.1. The vulnerabilities include memory exhaustion and denial of service issues in netty-codec-haproxy, netty-codec-redis, netty-codec-http2, and netty-transport-sctp; DNS cache poisoning in netty-resolver-dns; request smuggling in netty-codec-http; IPv6 subnet filter bypass and TLS hostname verification bypass in netty-handler; file descriptor leaks in netty-transport-native-epoll and netty-transport-native-kqueue; and other resource leaks and improper validation issues. The advisory references 19 CVEs, including CVE-2026-42587 which describes a denial of service via unbounded memory allocation in HTTP content decompression. The update upgrades Netty from version 4.1.133.Final-redhat-00001 to 4.1.135.Final-redhat-00001 to address these issues.
Potential Impact
The vulnerabilities collectively could allow attackers to cause denial of service conditions through memory exhaustion, resource leaks, and request smuggling, potentially disrupting application availability. DNS cache poisoning vulnerabilities could lead to incorrect DNS resolutions, impacting data integrity and confidentiality. The TLS hostname verification bypass could allow man-in-the-middle attacks by disabling proper certificate validation. File descriptor leaks and other resource mismanagement could degrade system performance or stability. These issues are rated as having an important security impact by Red Hat.
Mitigation Recommendations
Red Hat has released an official security update that addresses all listed vulnerabilities by upgrading the Netty library to version 4.1.135.Final-redhat-00001. Users of Red Hat JBoss Enterprise Application Platform 8.1.7.1 and XP 6.0.5.1 should apply this update promptly. Before applying the update, ensure all previously released errata are applied and back up existing installations, including applications, configuration files, and databases. No additional mitigation steps are indicated beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:50085
- Cve Count
- 19
- Additional Cves
- ["CVE-2026-44249","CVE-2026-44250","CVE-2026-44890","CVE-2026-44893","CVE-2026-45416","CVE-2026-45536","CVE-2026-45673","CVE-2026-45674","CVE-2026-46340","CVE-2026-47244","CVE-2026-47691","CVE-2026-48006","CVE-2026-48043","CVE-2026-48059","CVE-2026-50010","CVE-2026-50011","CVE-2026-50020","CVE-2026-50560"]
- Cvss Version
- null
Threat ID: 6a757395bf8831d539d90992
Added to database: 08/07/2026, 05:56:37 UTC
Last enriched: 08/07/2026, 08:41:20 UTC
Last updated: 08/08/2026, 00:41:13 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.