Red Hat Product Errata RHSA-2026:53806 - Security Advisory
Issued:
2026-08-11
Updated:
2026-08-11

RHSA-2026:53806 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 7.4.25 security update

Type/Severity

Security Advisory: Important

Topic

A security update is now available for Red Hat JBoss Enterprise Application
Platform 7.4. Red Hat Product Security has rated this update as having a
security impact of Important. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java
applications based on the WildFly application runtime. This release of Red Hat
JBoss Enterprise Application Platform 7.4.25 serves as a replacement for Red Hat
JBoss Enterprise Application Platform 7.4.24, and includes bug fixes and
enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.25
Release Notes for information about the most significant bug fixes and
enhancements included in this release.

Security Fix(es):

  • netty-codec-redis: Netty: Denial of Service via malicious Redis array header

(CVE-2026-50011)

  • netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS

handshake (CVE-2026-45416)

  • netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis

payload with deeply nested arrays (CVE-2026-44250)

  • netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis

payloads (CVE-2026-44890)

  • netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded

memory growth from SctpMessage fragments (CVE-2026-46340)

  • netty-resolver-dns: Netty: Information disclosure and data manipulation due to

improper CNAME record validation (CVE-2026-45674)

  • netty-handler: Netty: Improper trust manager handling leads to hostname

verification bypass (CVE-2026-50010)

  • netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf

Leak in RedisArrayAggregator (CVE-2026-48006)

  • netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records

(CVE-2026-47691)

  • netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service

via memory leak from crafted PROXY protocol headers (CVE-2026-48059)

  • netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak

(CVE-2026-48043)

  • netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed

HAProxy message (CVE-2026-44893)

  • netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding

parsing (CVE-2026-42585)

  • netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in

HTTP content decompression (CVE-2026-42587)

  • netty-codec-http: Netty: Denial of Service via unbounded memory allocation in

HTTP content decompression (CVE-2026-42587)

  • netty-codec-http: Netty: HTTP request smuggling via URI manipulation and CRLF

injection (CVE-2026-41417)

  • netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler

Disabled Validation (CVE-2026-42578)

  • netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of

conflicting HTTP/1.0 headers (CVE-2026-42581)

  • netty-codec-http: Netty: Incorrect HTTP response parsing leads to data

confusion (CVE-2026-42584)

  • netty-codec-dns: Netty: High integrity impact due to improper DNS domain name

constraint enforcement (CVE-2026-42579)

  • picketlink-federation: auth bypass in Picketlink SAML unsolicited-response

(CVE-2026-10579)

  • bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java

(CVE-2026-0636)

  • bcprov-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java

(CVE-2026-0636)

  • bcprov-jdk15: LDAP injection vulnerability in LDAPStoreHelper.java

(CVE-2026-0636)

  • bcprov-jdk12: LDAP injection vulnerability in LDAPStoreHelper.java

(CVE-2026-0636)

  • bcpg-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource

exhaustion (CVE-2026-3505)

  • bcpg-jdk15on: unbounded PGP AEAD chunk size leads to pre-auth resource

exhaustion (CVE-2026-3505)

  • bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence

as valid (CVE-2026-5588)

  • bcpkix-jdk15on: PKIX draft CompositeVerifier accepts empty signature sequence

as valid (CVE-2026-5588)

  • bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks

correctly (CVE-2025-14813)

  • bcprov-jdk15on: GOSTCTR implementation unable to process more than 255 blocks

correctly (CVE-2025-14813)

  • bcprov-jdk15: GOSTCTR implementation unable to process more than 255 blocks

correctly (CVE-2025-14813)

  • bcprov-jdk12: GOSTCTR implementation unable to process more than 255 blocks

correctly (CVE-2025-14813)

  • bcprov-jdk15: private key leakage via non-constant time comparisons

(CVE-2026-5598)

  • bcprov-jdk12: private key leakage via non-constant time comparisons

(CVE-2026-5598)

  • artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and

exfiltration due to missing authentication (CVE-2026-27446)

  • netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)
  • jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Solution

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 7.4 ELS 7 x86_64

Fixes

  • BZ - 2444320 - CVE-2026-27446 org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
  • BZ - 2458634 - CVE-2026-5588 bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid
  • BZ - 2458635 - CVE-2026-5598 bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons
  • BZ - 2458638 - CVE-2026-3505 bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion
  • BZ - 2458640 - CVE-2025-14813 bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly
  • BZ - 2458641 - CVE-2026-0636 bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java
  • BZ - 2467540 - CVE-2026-41417 netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection
  • BZ - 2477217 - CVE-2026-42579 netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement
  • BZ - 2477220 - CVE-2026-42587 netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression
  • BZ - 2477224 - CVE-2026-42584 netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion
  • BZ - 2477226 - CVE-2026-42578 netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
  • BZ - 2477227 - CVE-2026-42585 netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing
  • BZ - 2477232 - CVE-2026-42581 netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers
  • BZ - 2477930 - artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default
  • BZ - 2480325 - CVE-2026-10579 picketlink-federation: auth bypass in Picketlink SAML unsolicited-response
  • BZ - 2480601 - CVE-2026-15554 undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery
  • BZ - 2480637 - CVE-2026-15555 jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller
  • BZ - 2482963 - artemis-core-client: Unsafe Reflection in Apache ActiveMQ Artemis Federation Message Deserialization
  • BZ - 2482965 - artemis-server: artemis-core-client: SSRF and Connector Injection in Apache ActiveMQ Artemis Federation Downstream Handler
  • BZ - 2483121 - CVE-2026-15556 picketlink-federation: picketlink SAML 2.0 auth bypass via missing assertions
  • BZ - 2483131 - CVE-2026-15560 openjdk-orb: unauthed class loading via IIOP in EAP
  • BZ - 2483133 - CVE-2026-15561 undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow
  • BZ - 2483135 - CVE-2026-15562 jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service
  • BZ - 2483136 - CVE-2026-46581 wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
  • BZ - 2483138 - CVE-2026-15563 wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS
  • BZ - 2488053 - CVE-2026-44890 netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads
  • BZ - 2488062 - CVE-2026-44250 netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays
  • BZ - 2488081 - CVE-2026-44249 netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation
  • BZ - 2488383 - CVE-2026-44893 netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message
  • BZ - 2488388 - CVE-2026-46340 netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments
  • BZ - 2488391 - CVE-2026-45416 netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake
  • BZ - 2488400 - CVE-2026-45674 netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation
  • BZ - 2488413 - CVE-2026-50011 netty-codec-redis: Netty: Denial of Service via malicious Redis array header
  • BZ - 2488429 - CVE-2026-50010 netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass
  • BZ - 2488433 - CVE-2026-48006 netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator
  • BZ - 2488437 - CVE-2026-48059 netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers
  • BZ - 2488439 - CVE-2026-47691 io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records
  • BZ - 2488442 - CVE-2026-48043 netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak
  • BZ - 2511026 - CVE-2026-68494 com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
  • JBEAP-33515 - (7.4.z) Upgrade netty from 4.1.133.Final-redhat-00001 to 4.1.135.Final-redhat-00001

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.