This security advisory for Red Hat JBoss Enterprise Application Platform 8.0.6 addresses four vulnerabilities: CVE-2024-8447 involves a deadlock caused by multiple join requests sent to the LRA Coordinator in the Narayana transaction manager; CVE-2024-47535 and CVE-2025-25193 are denial of service vulnerabilities affecting Windows applications using the Netty networking library; CVE-2025-24970 concerns improper validation of SSL packets in the Netty SslHandler component, which can lead to a native crash when using the native SSLEngine. The update upgrades Netty from version 4.1.114.Final-redhat-00001 to 4.1.119.Final-redhat-00002 and includes fixes for these issues. The advisory rates the security impact as important and provides instructions for applying the update. No known exploits in the wild have been reported at this time.

The vulnerabilities could lead to denial of service conditions on Windows applications using Netty, a native crash due to SSL packet validation errors, and a deadlock in the transaction coordinator component. These issues may affect application availability and stability but do not explicitly describe remote code execution or data disclosure. The security impact is rated as important by Red Hat.

A security update to Red Hat JBoss Enterprise Application Platform 8.0.6 is available and should be applied to remediate these vulnerabilities. The update upgrades Netty to a fixed version and addresses the deadlock and SSL validation issues. Before applying the update, ensure all prior relevant errata are applied and back up existing installations, including applications and configurations. Follow Red Hat's official update instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.