What’s Vulnerable › Products
Red Hat JBoss EAP vulnerabilities
243 known vulnerabilities, 6 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.
Check whether your Red Hat JBoss EAP version is affected
Exploited Red Hat JBoss EAP vulnerabilities
- CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability
- CVE-2010-1428 — Red Hat JBoss Information Disclosure Vulnerability
- CVE-2010-0738 — Red Hat JBoss Authentication Bypass Vulnerability
- CVE-2017-12617 — Apache Tomcat Remote Code Execution Vulnerability
- CVE-2017-12149 — Red Hat JBoss Application Server Remote Code Execution Vulnerability
- CVE-2010-1871 — Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
Latest Red Hat JBoss EAP vulnerabilities
- CVE-2026-49875 — Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils (CVSS 9.8)
- CVE-2026-28369 — Undertow: undertow: request smuggling via malformed http request headers (CVSS 9.1)
- CVE-2026-28368 — Undertow: undertow: request smuggling via inconsistent header parsing (CVSS 9.1)
- CVE-2026-28367 — Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator (CVSS 9.1)
- CVE-2026-3121 — Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission (CVSS 7.2)
- CVE-2026-4874 — Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation (CVSS 3.1)
- CVE-2026-4366 — Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak (CVSS 5.8)
- CVE-2026-3009 — Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass) (CVSS 8.1)
- CVE-2025-12543 — Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf (CVSS 9.6)
- CVE-2025-9784 — Undertow: undertow madeyoureset http/2 ddos vulnerability (CVSS 7.5)
- CVE-2025-5731 — Infinispan: credential leakage in infinispan cli (CVSS 5.5)
- CVE-2025-23368 — Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli (CVSS 8.1)
- CVE-2025-23367 — Org.wildfly.core:wildfly-server: wildfly improper rbac permission (CVSS 6.5)
- CVE-2023-1932 — Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss (CVSS 6.1)
- CVE-2024-10234 — Wildfly: wildfly vulnerable to cross-site scripting (xss) (CVSS 7.3)
- CVE-2024-7885 — Undertow: improper state management in proxy protocol parsing causes information leakage (CVSS 7.5)
- CVE-2024-1102 — Jberet: jberet-core logging database credentials (CVSS 6.5)
- CVE-2024-1635 — Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol (CVSS 7.5)
- CVE-2023-4503 — Eap-galleon: custom provisioning creates unsecured http-invoker (CVSS 7.5)
- CVE-2023-3171 — Eap-7: heap exhaustion via deserialization (CVSS 7.5)
- CVE-2023-48795 — Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin (CVSS 5.9)
- CVE-2023-3629 — Infinispan: non-admins should not be able to get cache config via rest api (CVSS 6.5)
- CVE-2023-3628 — Infispan: rest bulk ops don't check permissions (CVSS 6.5)
- CVE-2023-5379 — Undertow: ajp request closes connection exceeding maxrequestsize (CVSS 7.5)
- CVE-2023-4061 — Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor (CVSS 6.5)