What’s Vulnerable › Products
Red Hat Fuse 7 vulnerabilities
26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 22 published in the last 12 months.
Check whether your Red Hat Fuse 7 version is affected
Latest Red Hat Fuse 7 vulnerabilities
- CVE-2026-91920 — Undertow: undertow: chunkreader message length permits chunk-size overflow (CVSS 6.5)
- CVE-2026-84823 — Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role (CVSS 7.1)
- CVE-2026-85634 — Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name (CVSS 8.8)
- CVE-2026-93432 — Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus (CVSS 6.1)
- CVE-2026-93569 — Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority (CVSS 8.2)
- CVE-2026-93568 — Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests (CVSS 7.5)
- CVE-2026-93567 — Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority (CVSS 7.5)
- CVE-2026-93564 — Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881) (CVSS 7.5)
- CVE-2026-85511 — Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2 (CVSS 4.2)
- CVE-2026-10832 — Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload (CVSS 5.9)
- CVE-2026-89058 — Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config (CVSS 7.4)
- CVE-2026-89059 — Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) (CVSS 7.5)
- CVE-2026-81624 — Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite (CVSS 7.5)
- CVE-2026-14180 — Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap (CVSS 5.3)
- CVE-2026-24330 — Wildfly-core: wildfly: arbitrary file read via malicious archive deployment (CVSS 6.5)
- CVE-2026-24329 — Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user. (CVSS 4.9)
- CVE-2026-6857 — Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization (CVSS 7.5)
- CVE-2026-28367 — Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator (CVSS 9.1)
- CVE-2024-4027 — Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks (CVSS 7.5)
- CVE-2026-0603 — Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection (CVSS 8.3)
- CVE-2025-7195 — Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd (CVSS 6.4)
- CVE-2024-11831 — Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript (CVSS 5.4)
- CVE-2024-5971 — Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket (CVSS 7.5)
- CVE-2024-6162 — Undertow: url-encoded request path information can be broken on ajp-listener (CVSS 7.5)
- CVE-2023-6717 — Keycloak: xss via assertion consumer service url in saml post-binding flow (CVSS 6.0)