Red Hat Product Errata RHSA-2026:36342 - Security Advisory
Issued:
2026-07-07
Updated:
2026-07-07

RHSA-2026:36342 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Enterprise Application Platform 8.1.7 security update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 8.

Description

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.7 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.6, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.7 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • io.undertow.jastow-jastow: Jastow Cross-Site Scripting attack due to unsanitized URI (CVE-2025-12799)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 8.1 for RHEL 8 x86_64

Fixes

  • BZ - 2413071 - CVE-2025-12799 jastow: Jastow Cross-Site Scripting attack due to unsanitized URI
  • JBEAP-32488 - Tracker bug for the EAP 8.1.7 release for RHEL-8
  • JBEAP-31549 - (8.1.z) Upgrade Jastow from 2.2.9.Final-redhat-00001 to 2.2.9.SP1-redhat-00001
  • JBEAP-32062 - (8.1.z) Upgrade JGroups from 5.3.21.Final-redhat-00001 to 5.3.23.Final-redhat-00001
  • JBEAP-32528 - (8.1.z) Upgrade WildFly Elytron from 2.6.8.Final-redhat-00001 to 2.6.9.Final-redhat-00001
  • JBEAP-32838 - (8.1.z) Upgrade hibernate ORM from 6.6.48.Final-redhat-00001 to 6.6.50.Final-redhat-00001
  • JBEAP-32871 - (8.1.z) Upgrade JBoss EAP to 8.1.1.GA-redhat-00019 in 8.1 Update 7
  • JBEAP-32962 - (8.1.z) Upgrade WildFly Core from 27.1.10.Final-redhat-00001 to 27.1.11.Final-redhat-00001
  • JBEAP-32963 - (8.1.z) Update EAP channel to use wildfly-ee-feature-pack-product-conf x.x.x in EAP 8.1 Update 7
  • JBEAP-33022 - (8.1.z) Upgrade JBossWS-CXF from 7.3.7.Final-redhat-00001 to 7.3.8.Final-redhat-00001
  • JBEAP-33158 - (8.1.z) Upgrade WildFly Core from 27.1.11.Final-redhat-00001 to 27.1.12.Final-redhat-00001
  • JBEAP-33551 - (8.1.z) Upgrade Undertow from 2.3.24.SP2-redhat-00001 to 2.3.24.SP3-redhat-00001

JBoss Enterprise Application Platform 8.1 for RHEL 8

SRPM
eap8-apache-cxf-4.0.10-3.redhat_00001.1.el8eap.src.rpm SHA-256: ff2929e2f8eff8fa0a26388fbb9b2c9ca0aceb46e4cd367465e83ac733c486bc
eap8-artemis-wildfly-integration-2.0.4-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 15178e0aee2be6c7d2f911a9c979a43af2e9665fbadd9b69dbe3e9b2c5d6028d
eap8-eap-product-conf-parent-801.7.0-1.GA_redhat_00001.1.el8eap.src.rpm SHA-256: d0a90650f2e94e1394183081f115126f5a6247c1e2caa14dca6bcc95b371d105
eap8-hibernate-6.6.50-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: e04d9fb6aed52d52553ebc076490d7ec362ee5ad37bc09d8f6e911575c9f2384
eap8-jbossws-cxf-7.3.8-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 931c779e44b7ab2925ace360fde7ba9a8beea93285b5d58fef30de337223a569
eap8-jgroups-5.3.23-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 8b1a8b21df55cbe41ecc8f767777ca9f617d47e861395f2a56589f6d8d4404cc
eap8-undertow-2.3.24-4.SP3_redhat_00001.1.el8eap.src.rpm SHA-256: 06d0c4bb93fb3849f1ba78291636a024f855e8535c57dc096d03d70733e1c254
eap8-undertow-jastow-2.2.9-1.SP1_redhat_00001.1.el8eap.src.rpm SHA-256: d3225bf668c7135629a22ba6d504cdcd7395a445d692fab5dd0214a6ae2f6510
eap8-wildfly-8.1.7-4.GA_redhat_00003.1.el8eap.src.rpm SHA-256: 31eeadc2c7921ba1d85e82b010a636fb28b5b4a9a44a8c600567b0b5377bc0df
eap8-wildfly-elytron-2.6.9-1.Final_redhat_00001.1.el8eap.src.rpm SHA-256: 33fb64e68914ed45a65d2e46fd1189165ffd61c5b45e34d138ba165c01efaede
eap8-wildfly-javadocs-8.1.1-11.GA_redhat_00019.1.el8eap.src.rpm SHA-256: 68301b47dd2a1942a29059e0638e6948ceb3a7615210ea11e326d32cf0df188d
x86_64
eap8-apache-cxf-4.0.10-3.redhat_00001.1.el8eap.noarch.rpm SHA-256: df034aa600e174aadf4f45b0f8c7ed1f6a5b4a6ebd92ecb2073b573fc43bbb83
eap8-apache-cxf-rt-4.0.10-3.redhat_00001.1.el8eap.noarch.rpm SHA-256: 76572ed5164111738703f4296275a7d45c9695f86c36e15c318950affa13a4c6
eap8-apache-cxf-services-4.0.10-3.redhat_00001.1.el8eap.noarch.rpm SHA-256: 92ec42be87c8d76ac71ef2eb1c3d3cdc8621972ff2e31ca18fc5d469b22011a1
eap8-apache-cxf-tools-4.0.10-3.redhat_00001.1.el8eap.noarch.rpm SHA-256: 105e2f689856def2ba004ca3b07c3fc710402ce01c1117d44a98b44383c422ff
eap8-artemis-wildfly-integration-2.0.4-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 069f6b744117b55b35b3848fe9f882c920ba485148809d0d6550bcb95b56fdb9
eap8-eap-product-conf-parent-801.7.0-1.GA_redhat_00001.1.el8eap.noarch.rpm SHA-256: f4e25db5b85b926c91ec025b11ef0962ee405f5f0d950671a91e4d59a1914177
eap8-eap-product-conf-wildfly-ee-feature-pack-801.7.0-1.GA_redhat_00001.1.el8eap.noarch.rpm SHA-256: efc456aedfcb5bc04a5bd28b3372286f5f462cfeb0dbb367ab3a19cfee0f6013
eap8-hibernate-6.6.50-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 41a2065228a51dc5931db0b83f3c849b774f3d367368115e7d48118b052746e5
eap8-hibernate-core-6.6.50-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 011c029034fa97cbfb946f7ca9030aa6f57a8659b563ff25fd25aa27b1a97be7
eap8-hibernate-envers-6.6.50-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 17997179f6916ce4c1c2ca01e7bcf47a41ad1947b601f0e4ea03e0a39518c54d
eap8-jbossws-cxf-7.3.8-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: b7dec61a731c177a108285dc78eef4859dc63ba2bef9203d3bdc1160471f9b15
eap8-jgroups-5.3.23-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 65dc05cee27d6ba59d797bb56568022162717334bb42b91540aed9d946711dcc
eap8-undertow-2.3.24-4.SP3_redhat_00001.1.el8eap.noarch.rpm SHA-256: a701bb592bdd4bdbc364048250172b4d7965a225ef77a0387a070816a65dd358
eap8-undertow-jastow-2.2.9-1.SP1_redhat_00001.1.el8eap.noarch.rpm SHA-256: f4e67957448dfd7aac538efbcec3e2dfaca466f1a1456f096f12e897f8be0e04
eap8-wildfly-8.1.7-4.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 31a8bbaf1edfa226fc75eed157ba8294dedd146a6840abe4b445443fc511779a
eap8-wildfly-elytron-2.6.9-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 1d42eea43837e5451cc736f2a4d55fc5bdb433227953ab306e0818d641466c23
eap8-wildfly-elytron-tool-2.6.9-1.Final_redhat_00001.1.el8eap.noarch.rpm SHA-256: 7caebfaaddf5bff7c97f5dda6da757b4374c474f079c9bd953717e10794b3c67
eap8-wildfly-java-jdk17-8.1.7-4.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 555b0b7f73339f8bfee32c27f87997cdebb2fce8097936da5cccf0963a887f65
eap8-wildfly-java-jdk21-8.1.7-4.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: 45c28d7a652373ea60da37460ec6764ffe0024ce319cc3032d685691e50a55ef
eap8-wildfly-javadocs-8.1.1-11.GA_redhat_00019.1.el8eap.noarch.rpm SHA-256: 000e46ebde5aa3f5b17c50ea6e8f70566ab2ebaa98f4d1d0d22b9a2f12b78a74
eap8-wildfly-modules-8.1.7-4.GA_redhat_00003.1.el8eap.noarch.rpm SHA-256: bd55e7d1dae098b837eb9b08335ba37f4c717df75ddd4ec1825e2355d235b4dc

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.