CVE-2025-12799: Jastow: jastow cross-site scripting attack due to unsanitized uri

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-07 · updated 2026-09-29
Weakness: CWE-79

Description

A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling.

Affected products

Red Hat JBoss Enterprise Application Platform 7: all versions
Red Hat JBoss Enterprise Application Platform 8: all versions
Red Hat JBoss Enterprise Application Platform 8.1.7.GA: all versions — fixed in 2.2.9.SP1-redhat-00001
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10: all versions — fixed in 0:0.1.0-2.redhat_00010.1.el10eap, 0:0.1.10-1.Final_redhat_00001.1.el10eap, 0:0.10.0-2.redhat_00001.1.el10eap, 0:0.8.12-1.redhat_00001.1.el10eap, 0:0.9.6-2.redhat_00002.1.el10eap, 0:1-9.el10eap
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8: all versions — fixed in 0:2.0.4-1.Final_redhat_00001.1.el8eap, 0:2.2.9-1.SP1_redhat_00001.1.el8eap, 0:2.3.24-4.SP3_redhat_00001.1.el8eap, 0:2.6.9-1.Final_redhat_00001.1.el8eap, 0:4.0.10-3.redhat_00001.1.el8eap, 0:6.6.50-1.Final_redhat_00001.1.el8eap
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9: all versions — fixed in 0:2.0.4-1.Final_redhat_00001.1.el9eap, 0:2.2.9-1.SP1_redhat_00001.1.el9eap, 0:2.3.24-4.SP3_redhat_00001.1.el9eap, 0:2.6.9-1.Final_redhat_00001.1.el9eap, 0:4.0.10-3.redhat_00001.1.el9eap, 0:6.6.50-1.Final_redhat_00001.1.el9eap
Red Hat JBoss Enterprise Application Platform Expansion Pack: all versions
Red Hat Single Sign-On 7: all versions

How to fix

Upgrade to a fixed version: Red Hat JBoss Enterprise Application Platform 8.1.7.GA 2.2.9.SP1-redhat-00001; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 0:0.1.0-2.redhat_00010.1.el10eap, 0:0.1.10-1.Final_redhat_00001.1.el10eap, 0:0.10.0-2.redhat_00001.1.el10eap, 0:0.8.12-1.redhat_00001.1.el10eap; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:2.0.4-1.Final_redhat_00001.1.el8eap, 0:2.2.9-1.SP1_redhat_00001.1.el8eap, 0:2.3.24-4.SP3_redhat_00001.1.el8eap, 0:2.6.9-1.Final_redhat_00001.1.el8eap; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:2.0.4-1.Final_redhat_00001.1.el9eap, 0:2.2.9-1.SP1_redhat_00001.1.el9eap, 0:2.3.24-4.SP3_redhat_00001.1.el9eap, 0:2.6.9-1.Final_redhat_00001.1.el9eap. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-12799 or the next vulnerability affects your stack