What’s Vulnerable › Products
Red Hat JBoss Enterprise Application Platform 8 vulnerabilities
36 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 35 published in the last 12 months.
Check whether your Red Hat JBoss Enterprise Application Platform 8 version is affected
Latest Red Hat JBoss Enterprise Application Platform 8 vulnerabilities
- CVE-2026-119542 — Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror (CVSS 4.3)
- CVE-2026-91920 — Undertow: undertow: chunkreader message length permits chunk-size overflow (CVSS 6.5)
- CVE-2026-114488 — Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding (CVSS 7.4)
- CVE-2026-19610 — Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean (CVSS 6.5)
- CVE-2026-15564 — Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization (CVSS 7.4)
- CVE-2026-84725 — Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap (CVSS 8.1)
- CVE-2026-114370 — Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal (CVSS 3.7)
- CVE-2026-84823 — Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role (CVSS 7.1)
- CVE-2026-85634 — Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name (CVSS 8.8)
- CVE-2026-93574 — Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing (CVSS 6.5)
- CVE-2026-93562 — Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling (CVSS 6.5)
- CVE-2026-93573 — Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling (CVSS 6.5)
- CVE-2026-93566 — Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line (CVSS 6.5)
- CVE-2026-93565 — Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte (CVSS 7.5)
- CVE-2026-93558 — Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service (CVSS 7.5)
- CVE-2026-93491 — Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue (CVSS 7.5)
- CVE-2026-93488 — Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams (CVSS 7.5)
- CVE-2026-89058 — Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config (CVSS 7.4)
- CVE-2026-89059 — Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) (CVSS 7.5)
- CVE-2026-81829 — Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver (CVSS 5.3)
- CVE-2026-86404 — Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default (CVSS 8.8)
- CVE-2026-17615 — Resteasy-core: resteasy sourceprovider remote unauthenticated file read (CVSS 7.5)
- CVE-2026-81624 — Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite (CVSS 7.5)
- CVE-2026-5680 — Undertow-core: undertow: denial of service via websocket permessage-deflate processing (CVSS 7.5)
- CVE-2026-19611 — Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding (CVSS 7.4)