Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.7 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.6, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.7 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* io.undertow.jastow-jastow: Jastow Cross-Site Scripting attack due to unsanitized URI (CVE-2025-12799)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.
Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.1, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.2 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* org.eclipse.jgit: XXE vulnerability in Eclipse JGit [eap-8.1.z] (CVE-2025-4949)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime.
This asynchronous patch is an update for Red Hat JBoss Enterprise Application Platform 8.0. See Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-55163)
* netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions [eap-8.0.z] (CVE-2025-58056)
* cxf: CXF JMS Code Execution Vulnerability (CVE-2025-48913)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.0.8 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.0.7, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.0.8 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* org.jboss.hal-hal-parent: base-x homograph attack allows Unicode lookalike characters to bypass validation. [eap-8.0.z] (CVE-2025-27611)
* org.jboss.hal-hal-parent: Stored Cross-Site Scripting (XSS) in JBoss EAP Management Console [eap-8.0.z] (CVE-2025-2901)
* wildfly-ejb3: Improper Deserialization in JBoss Marshalling Allows Remote Code Execution [eap-8.0.z] (CVE-2025-2251)
* org.apache.cxf/cxf-core: Apache CXF: Denial of Service vulnerability with temporary files [eap-8.0.z] (CVE-2025-23184)
* commons-beanutils-commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default [eap-8.0.z] (CVE-2025-48734)
* commons-beanutils-core: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default [eap-8.0.z] (CVE-2025-48734)
* org.jboss.eap-jboss-eap-xp: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default [eap-8.0.z] (CVE-2025-48734)
* commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default [eap-8.0.z] (CVE-2025-48734)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update has been released for Red Hat JBoss Enterprise Application Platform 8.0 addressing a vulnerability in the hornetq-core-client component. The vulnerability (CVE-2024-51127) allows arbitrary file overwrite or access to sensitive information. This issue is rated with an important security impact by Red Hat. The update is an asynchronous patch for version 8.0 update 5 and includes other bug fixes and enhancements.
CVE-2023-6236 is a high-severity vulnerability in Red Hat JBoss Enterprise Application Platform 8 related to insufficient verification of data authenticity in its OpenID Connect (OIDC) implementation. The flaw arises when a multi-tenant OIDC application accesses a second tenant secured by a different OIDC configuration but fails to prompt for re-authentication due to improper token validation logic. Specifically, the OidcSessionTokenStore component does not consider the new 'provider-url' parameter alongside the 'realm' parameter when deciding to reuse cached tokens, potentially allowing unauthorized access across tenants. This vulnerability does not affect EAP-7, which lacks the vulnerable 'provider-url' option. The CVSS 3.1 score is 7.3 (high), reflecting network exploitability without authentication or user interaction, and impacts confidentiality, integrity, and availability. No known exploits are reported in the wild yet. European organizations using Red Hat JBoss EAP 8 for multi-tenant OIDC applications should prioritize patching and reviewing their authentication flows to prevent cross-tenant token misuse.