Red Hat Product Errata RHSA-2026:36343 - Security Advisory
Issued:
2026-07-07
Updated:
2026-07-07

RHSA-2026:36343 - Security Advisory

Synopsis

Moderate: Red Hat JBoss Enterprise Application Platform 8.1.7 security update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1 for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.7 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.6, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.7 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • io.undertow.jastow-jastow: Jastow Cross-Site Scripting attack due to unsanitized URI (CVE-2025-12799)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 8.1 for RHEL 9 x86_64

Fixes

  • BZ - 2413071 - CVE-2025-12799 jastow: Jastow Cross-Site Scripting attack due to unsanitized URI
  • JBEAP-32489 - Tracker bug for the EAP 8.1.7 release for RHEL-9
  • JBEAP-31549 - (8.1.z) Upgrade Jastow from 2.2.9.Final-redhat-00001 to 2.2.9.SP1-redhat-00001
  • JBEAP-32062 - (8.1.z) Upgrade JGroups from 5.3.21.Final-redhat-00001 to 5.3.23.Final-redhat-00001
  • JBEAP-32528 - (8.1.z) Upgrade WildFly Elytron from 2.6.8.Final-redhat-00001 to 2.6.9.Final-redhat-00001
  • JBEAP-32838 - (8.1.z) Upgrade hibernate ORM from 6.6.48.Final-redhat-00001 to 6.6.50.Final-redhat-00001
  • JBEAP-32871 - (8.1.z) Upgrade JBoss EAP to 8.1.1.GA-redhat-00019 in 8.1 Update 7
  • JBEAP-32962 - (8.1.z) Upgrade WildFly Core from 27.1.10.Final-redhat-00001 to 27.1.11.Final-redhat-00001
  • JBEAP-32963 - (8.1.z) Update EAP channel to use wildfly-ee-feature-pack-product-conf x.x.x in EAP 8.1 Update 7
  • JBEAP-33022 - (8.1.z) Upgrade JBossWS-CXF from 7.3.7.Final-redhat-00001 to 7.3.8.Final-redhat-00001
  • JBEAP-33158 - (8.1.z) Upgrade WildFly Core from 27.1.11.Final-redhat-00001 to 27.1.12.Final-redhat-00001
  • JBEAP-33551 - (8.1.z) Upgrade Undertow from 2.3.24.SP2-redhat-00001 to 2.3.24.SP3-redhat-00001

JBoss Enterprise Application Platform 8.1 for RHEL 9

SRPM
eap8-apache-cxf-4.0.10-3.redhat_00001.1.el9eap.src.rpm SHA-256: 45af0fe0a1df3ac33f7debc768ad1b0d9f56b0ed4046c443345f89922d9f305b
eap8-artemis-wildfly-integration-2.0.4-1.Final_redhat_00001.1.el9eap.src.rpm SHA-256: d76a0b72c553ce1e508314fbd4e81665620225582deb82e919d0896a8163a465
eap8-eap-product-conf-parent-801.7.0-1.GA_redhat_00001.1.el9eap.src.rpm SHA-256: 58f03c86ebddf1fb75b34f65a648529d8df50f8653a6469f4712db353518dc00
eap8-hibernate-6.6.50-1.Final_redhat_00001.1.el9eap.src.rpm SHA-256: fd4c6f6ee2a27397daf98d3ab50cb9fe44652a4c0eeb2ea47c889577225ddf76
eap8-jbossws-cxf-7.3.8-1.Final_redhat_00001.1.el9eap.src.rpm SHA-256: 7fdb1f96bb0585af1729f10cf40eeda0bb11163835cc88e5838474243af77013
eap8-jgroups-5.3.23-1.Final_redhat_00001.1.el9eap.src.rpm SHA-256: 3164729df06af380b3c01f99fe133b25271235246deef166f85e48ce4c0bb087
eap8-undertow-2.3.24-4.SP3_redhat_00001.1.el9eap.src.rpm SHA-256: afb3eca6537a3dccda9e0ad25d228da4fe39f2850bfd9e1bdc6996f91458dbf7
eap8-undertow-jastow-2.2.9-1.SP1_redhat_00001.1.el9eap.src.rpm SHA-256: be648baa12fac167e9d59d83801a1c2811f0bb3de03df125aa51ddb62a2d3920
eap8-wildfly-8.1.7-4.GA_redhat_00003.1.el9eap.src.rpm SHA-256: fa0ca781d69fc779d1b6dc8a8a827eaf49eff6ca66692a576b814648a742e8fc
eap8-wildfly-elytron-2.6.9-1.Final_redhat_00001.1.el9eap.src.rpm SHA-256: 15a1bc0c5bbf3a13b19112896f26a5d6c9a02a7d4b8aadcfd5f8504549c99e52
eap8-wildfly-javadocs-8.1.1-11.GA_redhat_00019.1.el9eap.src.rpm SHA-256: a45d4dec8dbb95471cd3483c5b0867c9676018b29a65e913d849e3232e7becc2
x86_64
eap8-apache-cxf-4.0.10-3.redhat_00001.1.el9eap.noarch.rpm SHA-256: 805f19e86ffae03caabaa057dd0fe55d900736900d7b25a8aa3d3c1c8f45bc0f
eap8-apache-cxf-rt-4.0.10-3.redhat_00001.1.el9eap.noarch.rpm SHA-256: e73e4f774e102dd4883100cd6bef295d61f9218348011ee7c464d73b90244614
eap8-apache-cxf-services-4.0.10-3.redhat_00001.1.el9eap.noarch.rpm SHA-256: 92230f56ae067ef6d2df912e4de6fb4daadbd172b060c0f62c26b5f14305a988
eap8-apache-cxf-tools-4.0.10-3.redhat_00001.1.el9eap.noarch.rpm SHA-256: 690340ebbcbf3e8abf928644d4cbcf2f02c27386b913744d9a6485127fd2f0d4
eap8-artemis-wildfly-integration-2.0.4-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 903bb2e14a5d938773379c0359f025ff202438e338502f64e8a57cab82659fe4
eap8-eap-product-conf-parent-801.7.0-1.GA_redhat_00001.1.el9eap.noarch.rpm SHA-256: 43748ce7255523b22488c8882a9cac4bf6e5c892bad51f4e95a51dc9852b1612
eap8-eap-product-conf-wildfly-ee-feature-pack-801.7.0-1.GA_redhat_00001.1.el9eap.noarch.rpm SHA-256: 3eab173de66f4e1a2bb6dcdd6c37aa29b48758380fdf7431fcfd731cf93219bc
eap8-hibernate-6.6.50-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: b1b2d07d978208de738e7c744f5c0d9f4cf3082de944f74092f0b83546341173
eap8-hibernate-core-6.6.50-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 09ca657bde20f416032df0af0ffd4f4382973fe0d4e0f8936b31188fba3c7fc6
eap8-hibernate-envers-6.6.50-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 6f1e51ba26d6e578c760cc0a0d8881aa882c2f00e0ed405bbf5c714c6293ef28
eap8-jbossws-cxf-7.3.8-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 4dba1a55608314cb66c0b2692f199836a7ade641af208f0e74e2511e6f7e8ad8
eap8-jgroups-5.3.23-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: b8980c70a5e1075c88789aad13cc3cb63f00187685e6dcf07689a83125f9d6a5
eap8-undertow-2.3.24-4.SP3_redhat_00001.1.el9eap.noarch.rpm SHA-256: d654ad49dfa23cbc99b113a971f84d423a3b6b5b308654df4636995efa32fbb0
eap8-undertow-jastow-2.2.9-1.SP1_redhat_00001.1.el9eap.noarch.rpm SHA-256: ebe6563e7f1fd8eaba4dfc448f612b95fcd5a7cde3a2af9aac75fa14f7ee987d
eap8-wildfly-8.1.7-4.GA_redhat_00003.1.el9eap.noarch.rpm SHA-256: d30a6f766b78a31be664fd3c6a62830059db1159ea0e4a8934897f24ee3caf3c
eap8-wildfly-elytron-2.6.9-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 8da31901049998f7b5afc06a681736d7d02a21b12dcaec9a8eafaf2b0362ad9f
eap8-wildfly-elytron-tool-2.6.9-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 42022a9b7521e3eaf7f364e5eb6cc9ab9ee469761db5d5710566b3b8c62fdd17
eap8-wildfly-java-jdk17-8.1.7-4.GA_redhat_00003.1.el9eap.noarch.rpm SHA-256: 2fb2cf33f7cbc3a7c813c0d921e4a6500399f90fbc4a187ef076b1361284e5fe
eap8-wildfly-java-jdk21-8.1.7-4.GA_redhat_00003.1.el9eap.noarch.rpm SHA-256: 1b34538c4125ef2116553910548d339624e27f34fab1a76451e935092c32ad80
eap8-wildfly-javadocs-8.1.1-11.GA_redhat_00019.1.el9eap.noarch.rpm SHA-256: cedd6b83a6702d5dc7d7d4843b53689952473e1207be0f25b5ef22960840ec03
eap8-wildfly-modules-8.1.7-4.GA_redhat_00003.1.el9eap.noarch.rpm SHA-256: fcde6432a02a5b08c00e4f41a5ec32fdfbddbda92215a64261a82aadb571552f

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.