This is a cumulative patch release zip for the JBoss EAP XP 6.0.7 runtime distribution for use with EAP 8.1.9
Security Fix(es):
* netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) [eapxp-6] (CVE-2026-93579)
* netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority [eapxp-6] (CVE-2026-93569)
* netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests [eapxp-6] (CVE-2026-93568)
* netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority [eapxp-6] (CVE-2026-93567)
* netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size [eapxp-6] (CVE-2026-93492)
* netty-codec-http2: Netty: Information disclosure via CORS Vary header overwrite [eapxp-6] (CVE-2026-59903)
* netty-buffer: Netty: Information disclosure via CORS Vary header overwrite [eapxp-6] (CVE-2026-59903)
* parent: Apache ZooKeeper: Operational log forgery via newline injection [eapxp-6] (CVE-2026-84501)
* zookeeper: Apache ZooKeeper: Operational log forgery via newline injection [eapxp-6] (CVE-2026-84501)
* parent: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [eapxp-6] (CVE-2026-59969)
* zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [eapxp-6] (CVE-2026-59969)
* resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config [eapxp-6] (CVE-2026-89058)
* resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) [eapxp-6] (CVE-2026-89059)
* zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing [eapxp-6] (CVE-2026-90852)
* zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress [eapxp-6] (CVE-2026-90560)
* jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing [eapxp-6] (CVE-2026-68497)
* zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read [eapxp-6] (CVE-2026-89046)
* zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect [eapxp-6] (CVE-2026-87824)
* zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service [eapxp-6] (CVE-2026-87795)
* zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service [eapxp-6] (CVE-2026-87877)
* zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability [eapxp-6] (CVE-2026-87825)
* micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing [eapxp-6] (CVE-2026-59296)
* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching [eapxp-6] (CVE-2026-66257)
* proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation [eapxp-6] (CVE-2026-66273)
* resteasy-core: RESTeasy SourceProvider remote unauthenticated file read [eapxp-6] (CVE-2026-17615)
* proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting [eapxp-6] (CVE-2026-66274)
CVE-2026-121637 is a high-severity vulnerability in WatchGuard AuthPoint Authentication Gateway versions 1.0 up to but not including 7.6.0. It involves improper integrity validation of LDAP authentication callback data, allowing an attacker with a valid header signature to forge authentication results and transaction identifiers, potentially causing unauthorized session outcomes. The issue is fixed in version 7.6.0.
CVE-2026-121639 is a critical vulnerability in WatchGuard AuthPoint Authentication Gateway versions 1.0 up to but not including 7.6.0. It involves missing authentication for a critical function, allowing a remote unauthenticated attacker with network access to disrupt authentication services and delete local directory synchronization configuration. The flaw is fixed in version 7.6.0.
CVE-2026-121638 is a critical vulnerability in WatchGuard AuthPoint Authentication Gateway versions 1.0 up to but not including 7.6.0. It involves improper certificate validation that allows an attacker positioned on the network path to intercept and modify communications between the AuthPoint Gateway and local authentication providers. This flaw has been fixed in version 7.6.0.
CVE-2026-18963 is a vulnerability in WAGO version 7.36.156 involving the credential recovery process that allows unauthorized account takeover. Exploiting this flaw could enable attackers to access application resources with the privileges of the compromised user, potentially leading to unauthorized access to sensitive data, misuse of privileged functions, and modification of system settings.
CVE-2026-121373 is a vulnerability in the Symfony HtmlSanitizer component affecting versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The MetaRefreshAttributeSanitizer uses an overly restrictive regular expression to sanitize the refresh URL in meta tags, which can be bypassed. This allows an attacker to craft meta refresh tags that redirect users to untrusted sites, bypassing URL sanitization controls. The issue arises because the regular expression does not fully conform to the WHATWG HTML Standard for meta refresh directives, missing cases where the separator after the time is ASCII whitespace and the url= keyword is optional. The vulnerability is reachable under any configuration that allows meta tags with http-equiv and content attributes, including the allowStaticElements() preset.
CVE-2026-118516 is a vulnerability in the Symfony Routing component where the CompiledUrlMatcher and UrlMatcher interpret host and path information differently. This discrepancy allows path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The issue arises when routes define a host with placeholders that can consume parts of the path, causing unauthorized requests to reach protected controllers.
A time-of-check to time-of-use (TOCTOU) race condition in Apache ZooKeeper's setACL request handling allows a client to perform operations with permissions that have been revoked but not yet fully enforced. This can enable unauthorized actions such as committing writes or deletes after losing write access or re-granting full permissions persistently. The vulnerability affects Apache ZooKeeper versions up to and including 3.9.6. Upgrading to versions 3.8.8 or 3.9.7 resolves the issue.
Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to authenticate as an arbitrary user of the application, including a privileged one, following an incomplete fix for CVE-2026-45063.
X509Authenticator extracts the user identifier from the Subject DN (Distinguished Name) that the web server passes in $_SERVER['SSL_CLIENT_S_DN']. The fix for CVE-2026-45063 anchored that extraction to an RDN (Relative Distinguished Name) boundary, but the regular expression used was not escape-aware. The expression runs against an already serialized DN, so it cannot tell an RDN separator from a separator character that occurs inside a value. Under RFC 2253, used by Apache and by nginx's $ssl_client_s_dn, a comma inside a value is escaped as \, and the expression reads it as a separator regardless. RFC 2253 also does not treat / as a separator, so it leaves it bare inside a value, while the expression treats every / as one. The legacy X509_NAME_oneline() format, used by Apache's LegacyDNStringFormat and by nginx's $ssl_client_s_dn_legacy, is the mirror image: it escapes / as \/ and leaves , bare. In that format, a certificate with no emailAddress attribute, or whose poisoned CN precedes it, authenticates as the smuggled address.
To cover both RFC 2253 and the legacy X509_NAME_oneline() format, X509Authenticator and X509AuthenticationListener now split the DN into RDNs before looking for the attribute, instead of matching the attribute against the serialized string. They select the separator from the serialization, split on unescaped occurrences of that separator only, unescape each RDN afterwards with the rules of its format, and require the attribute to span a whole RDN. The accepted value grammar is unchanged.
Applications that pass a per-attribute user key (such as SSL_CLIENT_S_DN_Email) and deployments whose CA generates or validates the subject are not affected by this vulnerability.
The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the plugin's Remove mode to be active and the malicious comment to be published, either through auto-approval for known commenters or manual moderator approval.
Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request.
The multiRead handler places no limit on the number of bundled read operations or on the cumulative size of the response it builds in memory. Because each operation's result is fully materialized and retained before serialization, a request that is small on the wire — within the jute.maxbuffer limit — but that references a large znode many times can force the server to allocate far more heap than the request size implies, exhausting the JVM heap and terminating the server with an OutOfMemoryError. Neither jute.maxbuffer nor largeRequestMaxBytes prevents this, as both bound only the inbound request, not the response.
This issue affects Apache ZooKeeper from 3.7.0 through 3.9.6. Users are recommended to upgrade to version 3.9.7, which enforces configurable limits on the multiRead operation count and cumulative response size.
Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes (the default root ACL is open) can build a chain of nested znodes deep enough that taking a snapshot exhausts the JVM stack and kills the snapshot thread; sizes stay within jute.maxbuffer, so existing limits do not prevent it. This is a denial of service that becomes persistent: on restart the server rebuilds the deep tree from its transaction log and fails again while taking the startup snapshot, so it does not return to service, and recovery can entail data loss. The same log affects a leader and its followers, so it can spread across an ensemble.
This issue affects Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6. Users are recommended to upgrade to 3.8.8 or 3.9.7, which fix the issue. As a workaround, use ACLs and authentication to restrict znode creation rather than relying on the default open root ACL.
Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical request-processing thread and render the on-disk data directory permanently unbootable.
This issue affects Apache ZooKeeper up to and including 3.9.6. Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.
Improper Authorization vulnerability in Apache ZooKeeper.
When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canonicalization fails and the error is only logged. The client-requested authzid then becomes the session's SASL identity for all ACL checks.
An authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server's default realm, such as a principal from a cross-realm trusted realm. The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree.
Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.