Red Hat Product Errata RHSA-2026:70277 - Security Advisory
Issued:
2026-09-22
Updated:
2026-09-22

RHSA-2026:70277 - Security Advisory

Synopsis

Important: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

Type/Severity

Security Advisory: Important

Topic

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section

Description

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.8 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.7, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.8 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

  • jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z] (CVE-2026-68494)
  • netty-codec-http2: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [eap-8.1.z] (CVE-2026-56745)
  • netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration [eap-8.1.z] (CVE-2026-62243)
  • bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length [eap-8.1.z] (CVE-2026-59649)
  • jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified [eap-8.1.z] (CVE-2026-54515)
  • jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [eap-8.1.z] (CVE-2026-59889)
  • netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names [eap-8.1.z] (CVE-2026-73508)
  • jboss-eap.1-runtime-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z] (CVE-2026-68494)
  • jboss-eap-runtime-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z] (CVE-2026-68494)
  • bcprov-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion [eap-8.1.z] (CVE-2026-3505)
  • brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays [eap-8.1.z] (CVE-2026-69152)
  • netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [eap-8.1.z] (CVE-2026-59899)
  • netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header [eap-8.1.z] (CVE-2026-56746)
  • netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [eap-8.1.z] (CVE-2026-56745)
  • netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [eap-8.1.z] (CVE-2026-55831)
  • netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification [eap-8.1.z] (CVE-2026-55833)
  • jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [eap-8.1.z] (CVE-2026-54513)
  • jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [eap-8.1.z] (CVE-2026-54512)
  • undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap [eap-8.1.z] (CVE-2026-14180)
  • artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0 [eap-8.1.z] (CVE-2026-49363)
  • undertow-websockets-jsr: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method [eap-8.1.z] (CVE-2026-15565)
  • wildfly-iiop-openjdk: Wildfly: Pre-auth denial of service on the IIOP listener [eap-8.1.z] (CVE-2026-15567)
  • cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration [eap-8.1.z] (CVE-2026-50632)
  • cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening [eap-8.1.z] (CVE-2026-49875)
  • wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload [eap-8.1.z] (CVE-2026-10832)
  • cxf-rt-transports-jms: Apache CXF: Remote Code Execution via untrusted JMS configuration [eap-8.1.z] (CVE-2026-44417)
  • wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2 [eap-8.1.z] (CVE-2026-85511)
  • jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include [eap-8.1.z] (CVE-2026-46581)
  • wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS [eap-8.1.z] (CVE-2026-15563)
  • jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service [eap-8.1.z] (CVE-2026-15562)
  • undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow [eap-8.1.z] (CVE-2026-15561)
  • openjdk-orb: unauthed class loading via IIOP in EAP [eap-8.1.z] (CVE-2026-15560)
  • artemis-server: Apache Artemis — session hijack via missing authentication [eap-8.1.z] (CVE-2026-57967)
  • wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller [eap-8.1.z] (CVE-2026-15555)
  • undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery [eap-8.1.z] (CVE-2026-15554)
  • jgroups: artemis cluster password leak via jgroups spoof [eap-8.1.z] (CVE-2026-49364)
  • artemis-server: artemis core protocol permits unauthed queue creation [eap-8.1.z] (CVE-2026-49362)
  • artemis-server: artemis messaging handlers in Red Hat EAP permit deserialization by default [eap-8.1.z] (CVE-2026-86404)
  • undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing [eap-8.1.z] (CVE-2026-5680)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform Text-Only Advisories x86_64

Fixes

  • BZ - 2455350 - CVE-2026-5680 undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing
  • BZ - 2458638 - CVE-2026-3505 bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion
  • BZ - 2477930 - CVE-2026-86404 artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default
  • BZ - 2477945 - CVE-2026-49362 artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation
  • BZ - 2478013 - CVE-2026-49364 wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof
  • BZ - 2480601 - CVE-2026-15554 undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery
  • BZ - 2480637 - CVE-2026-15555 jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller
  • BZ - 2480638 - CVE-2026-57967 artemis-server: Apache Artemis ? session hijack via missing authentication
  • BZ - 2480729 - CVE-2026-44417 org.apache.cxf/cxf-rt-transports-jms: Apache CXF: Remote Code Execution via untrusted JMS configuration
  • BZ - 2483131 - CVE-2026-15560 openjdk-orb: unauthed class loading via IIOP in EAP
  • BZ - 2483133 - CVE-2026-15561 undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow
  • BZ - 2483135 - CVE-2026-15562 jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service
  • BZ - 2483136 - CVE-2026-46581 wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
  • BZ - 2483138 - CVE-2026-15563 wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS
  • BZ - 2483140 - CVE-2026-85511 wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2
  • BZ - 2484703 - CVE-2026-10832 org.wildfly.security/wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload
  • BZ - 2488304 - CVE-2026-50632 cxf: org.apache.cxf/cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration
  • BZ - 2488309 - CVE-2026-49875 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening
  • BZ - 2490628 - CVE-2026-15565 undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method
  • BZ - 2491620 - CVE-2026-15567 wildfly: wildfly-iiop: wildfly-jacorb: Wildfly: Pre-auth denial of service on the IIOP listener
  • BZ - 2492010 - CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
  • BZ - 2492015 - CVE-2026-54512 jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
  • BZ - 2492016 - CVE-2026-54515 jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified
  • BZ - 2492627 - CVE-2026-49363 artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0
  • BZ - 2494771 - CVE-2026-14180 undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap
  • BZ - 2500653 - CVE-2026-59889 com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties
  • BZ - 2503101 - CVE-2026-55833 netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification
  • BZ - 2503103 - CVE-2026-55831 io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing
  • BZ - 2505422 - CVE-2026-56746 io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header
  • BZ - 2505911 - CVE-2026-56745 netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec
  • BZ - 2507482 - CVE-2026-59899 io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)
  • BZ - 2510195 - CVE-2026-59649 org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length
  • BZ - 2510722 - CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
  • BZ - 2511026 - CVE-2026-68494 com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
  • BZ - 2515377 - CVE-2026-73508 io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names
  • BZ - 2521309 - CVE-2026-62243 io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration
  • JBEAP-32314 - [GSS](8.1.z) Upgrade ironjacamar from 3.0.18.Final-redhat-00001 to 3.0.22.Final-redhat-00001
  • JBEAP-32869 - [GSS](8.1.z] [LEAPP] Missing /opt/rh/eap8/root/usr/share/java/cxf-rt-features-throttling.jar after upgrade
  • JBEAP-33162 - (8.1.z) Upgrade JBoss EAP to 8.1.1.GA-redhat-00020 in 8.1 Update 8
  • JBEAP-33185 - (8.1.z) Upgrade WildFly Core from 27.1.12.Final-redhat-00001 to 27.1.13.Final-redhat-00001
  • JBEAP-33236 - (8.1.z) Upgrade log4j2 from 2.23.1.redhat-00002 to 2.25.4.redhat-00003
  • JBEAP-33237 - (8.1.z) Upgrade hibernate ORM from 6.6.50.Final-redhat-00001 to 6.6.51.Final-redhat-00001
  • JBEAP-33288 - (8.1.z) Upgrade WildFly Core from 27.1.13.Final-redhat-00001 to 27.1.14.Final-redhat-00001
  • JBEAP-33363 - (8.1.z) Update EAP channel to use wildfly-ee-feature-pack-product-conf x.x.x in EAP 8.1 Update 8
  • JBEAP-33405 - (8.1.z) Upgrade hibernate ORM from 6.6.51.Final-redhat-00001 to 6.6.53.Final-redhat-00001
  • JBEAP-33409 - [GSS](8.1.z) Upgrade org.apache.neethi:neethi from 3.2.1 to 3.2.2.redhat-00001 (resolves CVE-2026-42402/3/4)
  • JBEAP-33413 - (8.1.z) Upgrade WildFly Core from 27.1.14.Final-redhat-00001 to 27.1.15.Final-redhat-00001
  • JBEAP-33449 - [GSS](8.1.z) Upgrade jakarta.xml.bind-api from 4.0.4.redhat-00001 to 4.0.5.redhat-00001
  • JBEAP-33459 - JBoss EAP 8.1 Update 8 Release
  • JBEAP-33501 - (8.1.z) Upgrade wildfly-elytron from 2.6.9.Final-redhat-00001 to version 2.6.10.Final-redhat-00001
  • JBEAP-33616 - (8.1.z) Upgrade jboss-remoting from 5.0.31.Final-redhat-00001 to 5.0.31.SP2-redhat-00001
  • JBEAP-33640 - [GSS](8.1.z) Upgrade jackson-databind from 2.18.4.redhat-00002 to 2.18.9.redhat-00003
  • JBEAP-33683 - Upgrade wildfly-channel-maven-plugin in EAP to 1.0.33
  • JBEAP-33848 - (8.1.z) Acceptance tests failing with "Invalid archive: activemq-ra" after IronJamacar upgrade
  • JBEAP-33871 - [GSS](8.1.z) Upgrade nimbus-jose-jwt from 9.37.3.redhat-00001 to 9.37.4.redhat-00001 (resolves CVE-2025-53864)
  • JBEAP-33904 - (8.1.z) WFLY-21832 - (EE 10) Upgrade Undertow EE from 1.0.0.CR1 to 1.0.0.Final
  • JBEAP-33925 - (8.1.z) Upgrade wildfly-elytron from 2.6.10.Final-redhat-00001 to version 2.6.11.Final-redhat-00001
  • JBEAP-33967 - (8.1.z) Upgrade jboss-eap-installation-manager (Prospero) from 1.3.11.Final-redhat-00009 to 1.3.12
  • JBEAP-33968 - (8.1.z) Upgrade EAP Installer in EAP 8.1 Update 8
  • JBEAP-33973 - (8.1.z) Upgrade Eclipse Parsson from 1.1.7.redhat-00003 to 1.1.9.redhat-00001
  • JBEAP-34018 - (8.1.z) Upgrade wildfly-clustering from 5.0.12.Final-redhat-00001 to 5.0.13.Final-redhat-00001
  • JBEAP-34095 - (8.1.z) eap-81x-undertow-integration-tests-rhel tests failing after undertow upgrade
  • JBEAP-34096 - (8.1.z) eap-81x-scripts-basic-rhel tests failing after EAP upgrade
  • JBEAP-34111 - (8.1.z) Upgrade Netty from 4.1.135.Final-redhat-00001 to 4.1.136.Final-redhat-00001 (resolves numerous CVEs)
  • JBEAP-34161 - (8.1.z) Upgrade Hibernate from 6.6.53.Final-redhat-00001 to 6.6.54.Final-redhat-00001
  • JBEAP-34222 - (8.1.z) Upgrade artemis-wildfly-integration from 2.0.4.Final-redhat-00001 to 2.0.5.Final-redhat-00001
  • JBEAP-34521 - (8.1.z) Upgrade Undertow from 2.3.26.SP2-redhat-00001 to 2.3.26.SP3-redhat-00001

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.