CVE-2026-3505VulnerabilityPublished 22 Sep 2026Updated 26 Oct 2026

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

Affects Red HatSource GCVE Database

Mentioned vulnerabilities

Authoritative record:CVE-2026-3505· High 8.7

Not known to be exploited · CVSS 8.7 High · fixed in Red Hat package updates : patch Red Hat bcpg soon.

Data as of 26 Oct 2026, 17:16 UTC

CVSS 4.0 base score

8.7High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.7% chance of exploitation in 30 days – higher than 55% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 1.84, 1.81.1, 1.80.2

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable system confidentiality: None
Vulnerable system integrity: None
Vulnerable system availability: High
Subsequent system confidentiality: None
Subsequent system integrity: None
Subsequent system availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: None: The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: None: There is no loss of confidentiality within the Vulnerable System.
Vulnerable system integrity: None: There is no loss of integrity within the Vulnerable System.
Vulnerable system availability: High: There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Vulnerable System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the Vulnerable System (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
Subsequent system confidentiality: None: There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Subsequent system integrity: None: There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 15 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade BC-JAVA and org.bouncycastle/bcpg and bcpg to 1.84, 1.81.1 or 1.80.2.

Affected software

Product	Affected	Fixed in
Legion of the Bouncy Castle Inc.BC-JAVA	Affected >=1.82 <1.84	Fixed in 1.84
Legion of the Bouncy Castle Inc.BC-JAVA	Affected >=1.81 <1.81.1	Fixed in 1.81.1
Legion of the Bouncy Castle Inc.BC-JAVA	Affected >=1.74 <1.80.2	Fixed in 1.80.2
Mavenorg.bouncycastle/bcpg`pkg:maven/org.bouncycastle/bcpg`Other threats	Affected <1.80.2 >=1.81 <1.81.1 >=1.82 <1.84	Fixed in 1.80.2 1.81.1 1.84
GitHubbcpg`pkg:github/bcpg`Other threats	Affected >=1.74 <1.80.2 >=1.81 <1.81.1 >=1.82 <1.84	Fixed in 1.80.2 1.81.1 1.84

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.8 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.7, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.8 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z] (CVE-2026-68494) * netty-codec-http2: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [eap-8.1.z] (CVE-2026-56745) * netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration [eap-8.1.z] (CVE-2026-62243) * bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length [eap-8.1.z] (CVE-2026-59649) * jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified [eap-8.1.z] (CVE-2026-54515) * jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [eap-8.1.z] (CVE-2026-59889) * netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names [eap-8.1.z] (CVE-2026-73508) * jboss-eap.1-runtime-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z] (CVE-2026-68494) * jboss-eap-runtime-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z] (CVE-2026-68494) * bcprov-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion [eap-8.1.z] (CVE-2026-3505) * netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [eap-8.1.z] (CVE-2026-59899) * netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header [eap-8.1.z] (CVE-2026-56746) * netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [eap-8.1.z] (CVE-2026-56745) * netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [eap-8.1.z] (CVE-2026-55831) * netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification [eap-8.1.z] (CVE-2026-55833) * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [eap-8.1.z] (CVE-2026-54513) * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [eap-8.1.z] (CVE-2026-54512) * undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap [eap-8.1.z] (CVE-2026-14180) * artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0 [eap-8.1.z] (CVE-2026-49363) * undertow-websockets-jsr: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method [eap-8.1.z] (CVE-2026-15565) * wildfly-iiop-openjdk: Wildfly: Pre-auth denial of service on the IIOP listener [eap-8.1.z] (CVE-2026-15567) * cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration [eap-8.1.z] (CVE-2026-50632) * cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening [eap-8.1.z] (CVE-2026-49875) * wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload [eap-8.1.z] (CVE-2026-10832) * cxf-rt-transports-jms: Apache CXF: Remote Code Execution via untrusted JMS configuration [eap-8.1.z] (CVE-2026-44417) * wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2 [eap-8.1.z] (CVE-2026-85511) * jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include [eap-8.1.z] (CVE-2026-46581) * wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS [eap-8.1.z] (CVE-2026-15563) * jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service [eap-8.1.z] (CVE-2026-15562) * undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow [eap-8.1.z] (CVE-2026-15561) * openjdk-orb: unauthed class loading via IIOP in EAP [eap-8.1.z] (CVE-2026-15560) * artemis-server: Apache Artemis — session hijack via missing authentication [eap-8.1.z] (CVE-2026-57967) * wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller [eap-8.1.z] (CVE-2026-15555) * undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery [eap-8.1.z] (CVE-2026-15554) * jgroups: artemis cluster password leak via jgroups spoof [eap-8.1.z] (CVE-2026-49364) * artemis-server: artemis core protocol permits unauthed queue creation [eap-8.1.z] (CVE-2026-49362) * artemis-server: artemis messaging handlers

CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V8.1.4 (opens in a new tab)
V13.4.1 (opens in a new tab)
V11.1.4 (opens in a new tab)
Attack patterns
XML Ping of the Death (opens in a new tab)
Exponential Data Expansion (opens in a new tab)
Serialized Data Parameter Blowup (opens in a new tab)
Serialized Data with Nested Payloads (opens in a new tab)
Oversized Serialized Data Payloads (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1284Improper Validation of Specified Quantity in Input (opens in a new tab)
Base weakness
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-347Improper Verification of Cryptographic Signature (opens in a new tab)
Base weaknessOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
OWASP Cheat Sheets
XML Security (opens in a new tab)
REST Security (opens in a new tab)
JSON Web Token for Java (opens in a new tab)
REST Assessment (opens in a new tab)
Cross-Site Request Forgery Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.2 (opens in a new tab)
V3.5.3 (opens in a new tab)
V13.2.6 (opens in a new tab)
Attack patterns
Padding Oracle Crypto Attack (opens in a new tab)
Signature Spoofing by Improper Validation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (opens in a new tab)
Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Implementation
Use a web server that employs a strict HTTP parsing procedure, such as Apache.
Implementation
Use only SSL communication.
Implementation
Terminate the client session after each request.
OWASP Cheat Sheets
REST Assessment (opens in a new tab)
REST Security (opens in a new tab)
Cross-Site Request Forgery Prevention (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V13.2.5 (opens in a new tab)
Attack patterns
HTTP Response Smuggling (opens in a new tab)
HTTP Request Smuggling (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
OWASP Cheat Sheets
Transport Layer Protection (opens in a new tab)
TLS Cipher String (opens in a new tab)
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V9.2.1 (opens in a new tab)
V1.9.2 (opens in a new tab)
V2.8.5 (opens in a new tab)
Attack patterns
Creating a Rogue Certification Authority Certificate (opens in a new tab)
Signature Spoofing by Improper Validation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-502Deserialization of Untrusted Data (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #15OWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Architecture and Design · Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Implementation
Explicitly define a final object() to prevent deserialization.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
XML Security (opens in a new tab)
XML External Entity Prevention (opens in a new tab)
Software Supply Chain Security (opens in a new tab)
OWASP ASVS 4.0.3
V1.5.2 (opens in a new tab)
V5.5.3 (opens in a new tab)
V5.5.1 (opens in a new tab)
Attack patterns
Object Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-829Inclusion of Functionality from Untrusted Control Sphere (opens in a new tab)
Base weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Enforcement by Conversion
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
OWASP Cheat Sheets
Docker Security (opens in a new tab)
Vulnerable Dependency Management (opens in a new tab)
Software Supply Chain Security (opens in a new tab)
Infrastructure as Code (opens in a new tab)
OWASP ASVS 4.0.3
V12.3.6 (opens in a new tab)
V14.2.3 (opens in a new tab)
V14.2.4 (opens in a new tab)
Attack patterns
Serialized Data External Linking (opens in a new tab)
DTD Injection (opens in a new tab)
Local Code Inclusion (opens in a new tab)
PHP Local File Inclusion (opens in a new tab)
Remote Code Inclusion (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-190Integer Overflow or Wraparound (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V5.4.3 (opens in a new tab)
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
Attack patterns
Forced Integer Overflow (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-306Missing Authentication for Critical Function (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #21OWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Architecture and Design
Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment.
OWASP Cheat Sheets
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V1.2.3 (opens in a new tab)
V1.2.2 (opens in a new tab)
V1.2.4 (opens in a new tab)
Attack patterns
Choosing Message Identifier (opens in a new tab)
Force the System to Reset Values (opens in a new tab)
Using Unpublished Interfaces or Functionality (opens in a new tab)
Cross Site Request Forgery (opens in a new tab)
Communication Channel Manipulation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #11
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Operation · Build and Compilation · Environment Hardening
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…
OWASP Cheat Sheets
Docker Security (opens in a new tab)
XML Security (opens in a new tab)
OWASP ASVS 4.0.3
V5.4.1 (opens in a new tab)
V14.1.2 (opens in a new tab)
V13.3.1 (opens in a new tab)
Attack patterns
Buffer Overflow via Environment Variables (opens in a new tab)
Overflow Buffers (opens in a new tab)
Client-side Injection-induced Buffer Overflow (opens in a new tab)
Filter Failure through Buffer Overflow (opens in a new tab)
MIME Conversion (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-15External Control of System or Configuration Setting (opens in a new tab)
Base weaknessOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
One or more system settings or configuration elements can be externally controlled by a user.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Implementation · Architecture and Design
Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an…
Implementation · Architecture and Design
In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Subverting Environment Variable Values (opens in a new tab)
XML Schema Poisoning (opens in a new tab)
Manipulate Registry Information (opens in a new tab)
Modification of Registry Run Keys (opens in a new tab)
Schema Poisoning (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-94Improper Control of Generation of Code ('Code Injection') (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #10OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Architecture and Design · Refactoring
Refactor your program so that you do not have to dynamically generate code.
Architecture and Design
Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
Server Side Request Forgery Prevention (opens in a new tab)
Unvalidated Redirects and Forwards (opens in a new tab)
Cross Site Scripting Prevention (opens in a new tab)
DOM based XSS Prevention (opens in a new tab)
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V5.2.8 (opens in a new tab)
V5.2.5 (opens in a new tab)
V1.5.1 (opens in a new tab)
Attack patterns
Leverage Executable Code in Non-Executable Files (opens in a new tab)
Manipulating User-Controlled Variables (opens in a new tab)
Code Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-611Improper Restriction of XML External Entity Reference (opens in a new tab)
Base weaknessOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Implementation · System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
OWASP Cheat Sheets
Deserialization (opens in a new tab)
XML Security (opens in a new tab)
XML External Entity Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V5.5.2 (opens in a new tab)
Attack patterns
Data Serialization External Entities Blowup (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-184Incomplete List of Disallowed Inputs (opens in a new tab)
Base weaknessOWASP Top 10 A03:2021: Injection (opens in a new tab)
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
Implementation · Input Validation
Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity.
Attack patterns
Double Encoding (opens in a new tab)
Command Delimiters (opens in a new tab)
Flash Injection (opens in a new tab)
Using Leading 'Ghost' Character Sequences to Bypass Input Filters (opens in a new tab)
Exploiting Multiple Input Interpretation Layers (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes (opens in a new tab)
Base weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Implementation
If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.
Architecture and Design · Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Implementation · Input Validation
For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
OWASP Cheat Sheets
Mass Assignment (opens in a new tab)
Software Supply Chain Security (opens in a new tab)
Infrastructure as Code (opens in a new tab)
OWASP ASVS 4.0.3
V5.1.2 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-409Improper Handling of Highly Compressed Data (Data Amplification) (opens in a new tab)
Base weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.2 (opens in a new tab)
V12.1.1 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-772Missing Release of Resource after Effective Lifetime (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Implementation
It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free resources in a function. If you allocate resources that you intend to free upon completion of the function, you must be sure to free the resources at all exit points for that function including…
Operation · Architecture and Design · Resource Limitation
Use resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available.
Attack patterns
HTTP DoS (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-807Reliance on Untrusted Inputs in a Security Decision (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Architecture and Design · Attack Surface Reduction
Store state information and sensitive data on the server side only.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
OWASP Cheat Sheets
Secure Design Principles (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.1 (opens in a new tab)
Attack patterns
Regular Expression Exponential Blowup (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-290Authentication Bypass by Spoofing (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
OWASP Cheat Sheets
REST Security (opens in a new tab)
JSON Web Token for Java (opens in a new tab)
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V3.5.1 (opens in a new tab)
V2.8.5 (opens in a new tab)
V2.8.4 (opens in a new tab)
Attack patterns
Creating a Rogue Certification Authority Certificate (opens in a new tab)
Web Services API Signature Forgery Leveraging Hash Function Extension Weakness (opens in a new tab)
Signature Spoof (opens in a new tab)
Signature Spoofing by Misrepresentation (opens in a new tab)
Session Credential Falsification through Prediction (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

GCVE source: db.gcve.eu
Csaf Category: csaf_security_advisory
Csaf Version: 2.0
Publisher: Red Hat Product Security
Advisory ID: RHSA-2026:70277
Vendor Severity: high
CVE Count: 38
Additional Cves: CVE-2026-5680, CVE-2026-10832, CVE-2026-12185, CVE-2026-12860, CVE-2026-14180, CVE-2026-15554, CVE-2026-15555, CVE-2026-15560, CVE-2026-15561, CVE-2026-15562, CVE-2026-15563, CVE-2026-15565, CVE-2026-15567, CVE-2026-44417, CVE-2026-46581, CVE-2026-49362, CVE-2026-49363, CVE-2026-49364, CVE-2026-49875, CVE-2026-50632, CVE-2026-54512, CVE-2026-54513, CVE-2026-54515, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-57967, CVE-2026-58059, CVE-2026-59649, CVE-2026-59889, CVE-2026-59899, CVE-2026-62243, CVE-2026-68494, CVE-2026-73508, CVE-2026-85511, CVE-2026-86404

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

WeaknessesCWE-770, CWE-1284, CWE-347 +17

Technical details

References

Community reviews

Related threats