What’s Vulnerable › Products
Red Hat JBoss Enterprise Application Platform 7 vulnerabilities
43 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 42 published in the last 12 months.
Check whether your Red Hat JBoss Enterprise Application Platform 7 version is affected
Latest Red Hat JBoss Enterprise Application Platform 7 vulnerabilities
- CVE-2026-91920 — Undertow: undertow: chunkreader message length permits chunk-size overflow (CVSS 6.5)
- CVE-2026-19610 — Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean (CVSS 6.5)
- CVE-2026-15564 — Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization (CVSS 7.4)
- CVE-2026-84725 — Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap (CVSS 8.1)
- CVE-2026-114370 — Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal (CVSS 3.7)
- CVE-2026-84823 — Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role (CVSS 7.1)
- CVE-2026-85634 — Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name (CVSS 8.8)
- CVE-2026-93576 — Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419) (CVSS 7.5)
- CVE-2026-93569 — Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority (CVSS 8.2)
- CVE-2026-93568 — Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests (CVSS 7.5)
- CVE-2026-93567 — Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority (CVSS 7.5)
- CVE-2026-93564 — Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881) (CVSS 7.5)
- CVE-2026-93575 — Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder (CVSS 7.5)
- CVE-2026-93572 — Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits (CVSS 7.5)
- CVE-2026-93563 — Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos (CVSS 7.5)
- CVE-2026-93561 — Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling (CVSS 6.5)
- CVE-2026-93494 — Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated (CVSS 7.5)
- CVE-2026-89058 — Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config (CVSS 7.4)
- CVE-2026-89059 — Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) (CVSS 7.5)
- CVE-2026-86404 — Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default (CVSS 8.8)
- CVE-2026-81624 — Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite (CVSS 7.5)
- CVE-2026-5680 — Undertow-core: undertow: denial of service via websocket permessage-deflate processing (CVSS 7.5)
- CVE-2026-19611 — Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding (CVSS 7.4)
- CVE-2026-76166 — Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram (CVSS 4.3)
- CVE-2026-19879 — Io.undertow/undertow: undertow: http response header integrity issue due to character truncation (CVSS 5.3)