RHSA-2026:95221 - Security Advisory

Topic

JBoss EAP XP 6.0.7.GA release on the EAP 8.1.9 base. See references for release notes.

Description

This is a cumulative patch release zip for the JBoss EAP XP 6.0.7 runtime distribution for use with EAP 8.1.9

Security Fix(es):

• netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) [eapxp-6] (CVE-2026-93579)
• netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority [eapxp-6] (CVE-2026-93569)
• netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests [eapxp-6] (CVE-2026-93568)
• netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority [eapxp-6] (CVE-2026-93567)
• netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size [eapxp-6] (CVE-2026-93492)
• netty-codec-http2: Netty: Information disclosure via CORS Vary header overwrite [eapxp-6] (CVE-2026-59903)
• netty-buffer: Netty: Information disclosure via CORS Vary header overwrite [eapxp-6] (CVE-2026-59903)
• parent: Apache ZooKeeper: Operational log forgery via newline injection [eapxp-6] (CVE-2026-84501)
• zookeeper: Apache ZooKeeper: Operational log forgery via newline injection [eapxp-6] (CVE-2026-84501)
• parent: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [eapxp-6] (CVE-2026-59969)
• zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [eapxp-6] (CVE-2026-59969)
• resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config [eapxp-6] (CVE-2026-89058)
• resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) [eapxp-6] (CVE-2026-89059)
• zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing [eapxp-6] (CVE-2026-90852)
• zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress [eapxp-6] (CVE-2026-90560)
• jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing [eapxp-6] (CVE-2026-68497)
• zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read [eapxp-6] (CVE-2026-89046)
• zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect [eapxp-6] (CVE-2026-87824)
• zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service [eapxp-6] (CVE-2026-87795)
• zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service [eapxp-6] (CVE-2026-87877)
• zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability [eapxp-6] (CVE-2026-87825)
• micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing [eapxp-6] (CVE-2026-59296)
• proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching [eapxp-6] (CVE-2026-66257)
• proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation [eapxp-6] (CVE-2026-66273)
• resteasy-core: RESTeasy SourceProvider remote unauthenticated file read [eapxp-6] (CVE-2026-17615)
• proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting [eapxp-6] (CVE-2026-66274)

Solution

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

• JBoss Enterprise Application Platform Text-Only Advisories x86_64
• JBoss Enterprise Application Platform 7.4 ELS 7 x86_64

Fixes

• BZ - 2507635 - CVE-2026-17615 resteasy-core: RESTeasy SourceProvider remote unauthenticated file read
• BZ - 2511322 - CVE-2026-66273 org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation
• BZ - 2511326 - CVE-2026-66257 qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching
• BZ - 2511337 - CVE-2026-66274 org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting
• BZ - 2517538 - CVE-2026-59903 io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite
• BZ - 2519756 - CVE-2026-89059 resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS)
• BZ - 2519775 - CVE-2026-89058 resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config
• BZ - 2520949 - CVE-2026-59296 io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing
• BZ - 2530661 - CVE-2026-87795 com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service
• BZ - 2530998 - CVE-2026-87824 com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect
• BZ - 2531003 - CVE-2026-87877 com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service
• BZ - 2531007 - CVE-2026-87825 com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability
• BZ - 2531577 - CVE-2026-89046 zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read
• BZ - 2531964 - CVE-2026-68497 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing
• BZ - 2532604 - CVE-2026-90560 com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress
• BZ - 2533566 - CVE-2026-90852 com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing
• BZ - 2535096 - CVE-2026-84501 zookeeper: Apache ZooKeeper: Operational log forgery via newline injection
• BZ - 2535097 - CVE-2026-59969 zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise
• BZ - 2536895 - CVE-2026-93492 io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size
• BZ - 2536955 - CVE-2026-93567 io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority
• BZ - 2536961 - CVE-2026-93568 io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests
• BZ - 2536962 - CVE-2026-93569 io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority
• BZ - 2536970 - CVE-2026-93579 io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)
• JBEAP-34962 - Tracker for EAP XP 6.0.6.GA on EAP 8.1.9
• JBEAP-34119 - (xp-6.0.z) Upgrade JBoss EAP to 8.1.1.GA-redhat-00044 in XP6 Update 7
• JBEAP-34266 - (xp-6.0.z) Upgrade org.apache.qpid:proton-j from 0.34.1.redhat-00002 to 0.35.0.redhat-00001
• JBEAP-34330 - (xp-6.0.z) Upgrade JBoss EAP to 8.1.1.GA-redhat-00045 in XP6 Update 7
• JBEAP-34493 - (xp-6.0.z) Upgrade JBoss EAP to 8.1.1.GA-redhat-00049 in XP6 Update 7
• JBEAP-34505 - (xp-6.0.z) Upgrade io.prometheus from 1.3.1.redhat-00001 to 1.7.0
• JBEAP-34714 - (xp-6.0.z) Upgrade Netty from 4.1.136.Final-redhat-00001 to 4.1.137.Final-redhat-00001 (resolves numerous CVEs)
• JBEAP-34764 - (xp-6.0.z) Upgrade JBoss EAP to 8.1.1.GA-redhat-00050 in XP6 Update 7
• JBEAP-34906 - (xp-6.0.z) Upgrade JBoss EAP to 8.1.1.GA-redhat-00051 in XP6 Update 7
• JBEAP-34909 - (xp-6.0.z) Upgrade zstd-jni from 1.5.6.10-rhel8-redhat-00001 to version 1.5.7.16-rhel8-redhat-00001
• JBEAP-35053 - (xp-6.0.z) Upgrade resteasy to version 6.2.19.Final
• JBEAP-35057 - (xp-6.0.z) Upgrade JBoss EAP to 8.1.1.GA-redhat-00052 in XP6 Update 7.1
• JBEAP-35263 - (xp-6.0.z) Upgrade jackson from 2.18.10.redhat-00001 to 2.18.11
• JBEAP-35292 - (xp-6.0.z) Upgrade Netty from 4.1.137.Final-redhat-00001 to 4.1.138.Final-redhat-00001 (resolves numerous CVEs)

CVEs

• CVE-2026-17615
• CVE-2026-59296
• CVE-2026-59903
• CVE-2026-59969
• CVE-2026-66257
• CVE-2026-66273
• CVE-2026-66274
• CVE-2026-68497
• CVE-2026-84501
• CVE-2026-87795
• CVE-2026-87824
• CVE-2026-87825
• CVE-2026-87877
• CVE-2026-89046
• CVE-2026-89058
• CVE-2026-89059
• CVE-2026-90560
• CVE-2026-90852
• CVE-2026-93492
• CVE-2026-93567
• CVE-2026-93568
• CVE-2026-93569
• CVE-2026-93579

References

• https://access.redhat.com/security/updates/classification/#important
• https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index
• https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1