What’s Vulnerable › Products
Red Hat JBoss Enterprise Application Platform Expansion Pack vulnerabilities
29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 27 published in the last 12 months.
Check whether your Red Hat JBoss Enterprise Application Platform Expansion Pack version is affected
Latest Red Hat JBoss Enterprise Application Platform Expansion Pack vulnerabilities
- CVE-2026-119542 — Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror (CVSS 4.3)
- CVE-2026-19610 — Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean (CVSS 6.5)
- CVE-2026-93579 — Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough) (CVSS 6.5)
- CVE-2026-93569 — Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority (CVSS 8.2)
- CVE-2026-93568 — Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests (CVSS 7.5)
- CVE-2026-93567 — Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority (CVSS 7.5)
- CVE-2026-10832 — Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload (CVSS 5.9)
- CVE-2026-93492 — Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size (CVSS 5.3)
- CVE-2026-89058 — Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config (CVSS 7.4)
- CVE-2026-89059 — Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) (CVSS 7.5)
- CVE-2026-81829 — Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver (CVSS 5.3)
- CVE-2026-17615 — Resteasy-core: resteasy sourceprovider remote unauthenticated file read (CVSS 7.5)
- CVE-2026-5680 — Undertow-core: undertow: denial of service via websocket permessage-deflate processing (CVSS 7.5)
- CVE-2026-76166 — Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram (CVSS 4.3)
- CVE-2026-19879 — Io.undertow/undertow: undertow: http response header integrity issue due to character truncation (CVSS 5.3)
- CVE-2026-14180 — Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap (CVSS 5.3)
- CVE-2026-15555 — Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller (CVSS 8.8)
- CVE-2026-24330 — Wildfly-core: wildfly: arbitrary file read via malicious archive deployment (CVSS 6.5)
- CVE-2026-24329 — Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user. (CVSS 4.9)
- CVE-2026-17614 — Wildfly-core: path traversal on wildfly domain controller (CVSS 4.4)
- CVE-2025-12799 — Jastow: jastow cross-site scripting attack due to unsanitized uri (CVSS 6.5)
- CVE-2026-10805 — Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend (CVSS 6.7)
- CVE-2026-28367 — Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator (CVSS 9.1)
- CVE-2026-2733 — Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol (CVSS 3.8)
- CVE-2026-1190 — Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata (CVSS 3.1)