Threats Tagged 'cve-2026-86404'

Red Hat JBoss Enterprise Application Platform 8.1.8 addresses multiple security vulnerabilities affecting various components including Jackson libraries, Netty, Bouncy Castle, Undertow, Artemis server, Apache CXF, and WildFly Elytron. The update replaces version 8.1.7 and mitigates issues such as denial of service, privilege escalation, authentication bypass, information disclosure, and remote code execution. These vulnerabilities impact Red Hat JBoss EAP 8.1 for RHEL 8 and have been rated with an important security impact by Red Hat Product Security.

Red Hat JBoss Enterprise Application Platform 8.1.8 addresses multiple security vulnerabilities including denial of service, privilege escalation, authentication bypass, information disclosure, and remote code execution. These vulnerabilities affect various components such as Jackson libraries, Netty, Bouncy Castle, Undertow, Apache CXF, Artemis server, and WildFly Elytron. The update replaces version 8.1.7 and includes patches to mitigate these issues.

Red Hat JBoss Enterprise Application Platform (EAP) 8.1.8 addresses multiple important security vulnerabilities affecting versions 8.1.0 up to but not including 8.1.8. These vulnerabilities impact various components including Jackson libraries, Netty codecs, Bouncy Castle, Undertow, Artemis server, Apache CXF, and WildFly Elytron. The issues include denial of service, privilege escalation, arbitrary code execution, authentication bypass, information disclosure, and resource exhaustion. Users are advised to update to version 8.1.8 to mitigate these risks.

CVE-2026-86404 is a high severity vulnerability in Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 involving insecure deserialization. The Artemis messaging component permits deserialization of all classes by default due to empty allow-list and block-list configurations. This allows potentially unsafe objects to be deserialized, leading to high impact on confidentiality, integrity, and availability. A security update is available in Red Hat JBoss Enterprise Application Platform 7.4.25 that addresses this and other vulnerabilities.