RedHat Process Automation vulnerabilities

23 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Exploited RedHat Process Automation vulnerabilities

CVE-2026-28369 — Undertow: undertow: request smuggling via malformed http request headers (CVSS 9.1)
CVE-2026-28368 — Undertow: undertow: request smuggling via inconsistent header parsing (CVSS 9.1)
CVE-2026-28367 — Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator (CVSS 9.1)
CVE-2025-12543 — Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf (CVSS 9.6)
CVE-2025-9784 — Undertow: undertow madeyoureset http/2 ddos vulnerability (CVSS 7.5)
CVE-2024-7885 — Undertow: improper state management in proxy protocol parsing causes information leakage (CVSS 7.5)
CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability (CVSS 7.5) — exploited
CVE-2023-1108 — Undertow: infinite loop in sslconduit during close (CVSS 7.5)
CVE-2022-1415 — Drools: unsafe data deserialization in streamutils (CVSS 8.8)
CVE-2019-14841 — (CVSS 8.8)
CVE-2021-4178 — (CVSS 6.7)
CVE-2019-14839 — (CVSS 7.5)
CVE-2022-0853 — (CVSS 7.5)
CVE-2021-4104 — Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 (CVSS 7.5)
CVE-2021-3642 — (CVSS 5.3)
CVE-2021-20306 — (CVSS 4.3)
CVE-2021-20218 — (CVSS 7.4)
CVE-2020-10714 — (CVSS 7.5)
CVE-2020-1748 — (CVSS 7.5)
CVE-2020-1714 — (CVSS 8.8)
CVE-2019-14892 — (CVSS 9.8)
CVE-2019-14863 — (CVSS 6.1)
CVE-2019-14862 — (CVSS 6.1)