RHSA-2026:95887 - Security Advisory

Topic

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.

Security Fix(es):

• netty-codec-http2: Netty: Information disclosure via CORS Vary header overwrite [eap-8.1.z] (CVE-2026-59903)
• netty-buffer: Netty: Information disclosure via CORS Vary header overwrite [eap-8.1.z] (CVE-2026-59903)
• cxf: Apache CXF: Denial of service via many attachment headers [eap-8.1.z] (CVE-2026-64958)
• cxf: Apache CXF: Authentication Bypass via Crafted OIDC Self-Issued ID Tokens [eap-8.1.z] (CVE-2026-65583)
• cxf-xjc-bug986: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-ws-security: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• jbossws-cxf-server: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-xjc-runtime: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• jbossws-cxf-resources: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-wsdl: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-services-sts-core: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-tools-java2ws: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-ws-policy: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• jbossws-cxf-client: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-tools-wsdlto-frontend-jaxws: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-tools-common: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-xjc-dv: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-services-ws-discovery-api: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-tools-wsdlto-core: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• jbossws-cxf-transports-undertow: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-tools-wsdlto-databinding-jaxb: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-ws-rm: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-xjc-boolean: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-tools-validator: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• jbossws-cxf-transports-udp: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• jbossws-cxf-factories: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-xjc-ts: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-bindings-coloc: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-features-clustering: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-transports-local: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-transports-http-hc: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-security: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-transports-jms: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-core: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-databinding-aegis: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-management: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-features-throttling: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-features-logging: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-bindings-xml: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-security-saml: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-services-sts-core: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-tools-wsdlto-frontend-jaxws: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-services-ws-discovery-api: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-tools-common: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-tools-wsdlto-databinding-jaxb: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• jbossws-cxf-factories: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-xjc-runtime: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-tools-validator: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-xjc-dv: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-xjc-boolean: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-xjc-ts: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• jbossws-cxf-resources: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-xjc-bug986: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-tools-java2ws: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• jbossws-cxf-transports-udp: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• jbossws-cxf-client: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• jbossws-cxf-transports-undertow: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• jbossws-cxf-server: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-tools-wsdlto-core: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-bindings-coloc: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-security: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-databinding-aegis: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-ws-policy: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-features-logging: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-frontend-simple: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-ws-security: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-transports-jms: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-transports-http-hc: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-transports-local: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-bindings-xml: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-transports-http: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-ws-rm: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-frontend-jaxws: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-features-clustering: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-ws-mex: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-databinding-jaxb: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-bindings-soap: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-ws-addr: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-management: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-features-throttling: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-security-saml: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-core: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-wsdl: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432)
• cxf-rt-frontend-simple: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-ws-addr: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• wildfly-iiop-openjdk: EAP IIOP listeners may permit unauthed deserialization [eap-8.1.z] (CVE-2026-15564)
• wildfly-iiop-openjdk: Wildfly: Authentication bypass on IIOP EJB invocations as CSIv2 ITTPrincipalName accepted without transport binding [eap-8.1.z] (CVE-2026-114488)
• brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays [eap-8.1.z] (CVE-2026-69152)
• wildfly-deployment-repository: Path Traversal on WildFly Domain Controller [eap-8.1.z] (CVE-2026-17614)
• sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation [eap-8.1.z] (CVE-2026-56624)
• resteasy-core: RESTeasy SourceProvider remote unauthenticated file read [eap-8.1.z] (CVE-2026-17615)
• wildfly-platform-mbean: wildfly-platform-mbean: RBAC sensitive attribute read bypass for platform RuntimeMxBean [eap-8.1.z] (CVE-2026-19610)
• cxf-rt-transports-jms: Apache CXF: Remote Code Execution via unsafe deserialization of JMS ObjectMessage [eap-8.1.z] (CVE-2026-66909)
• wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding [eap-8.1.z] (CVE-2026-19611)
• jboss-eap-runtime-maven-repository.zip: js-yaml: Denial of Service vulnerability in YAML parsing [eap-8.1.z] (CVE-2026-84375)
• openjdk-orb: Incomplete fix for CVE-2026-15560,unauthed class loading via IIOP in EAP [eap-8.1.z] (CVE-2026-84725)
• wildfly-server: wildfly-core: Deployer RBAC role privilege escalation via path traversal in deployment name [eap-8.1.z] (CVE-2026-85634)
• resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) [eap-8.1.z] (CVE-2026-89059)
• netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams [eap-8.1.z] (CVE-2026-93488)
• resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config [eap-8.1.z] (CVE-2026-89058)
• netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue [eap-8.1.z] (CVE-2026-93491)
• netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service [eap-8.1.z] (CVE-2026-93558)
• netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte [eap-8.1.z] (CVE-2026-93565)
• netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext [eap-8.1.z] (CVE-2026-75595)
• bcprov-jdk18on: Bouncy Castle for Java: Authenticated Encryption Forgery Vulnerability [eap-8.1.z] (CVE-2026-12803)
• bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing [eap-8.1.z] (CVE-2026-13506)
• bcprov-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded memory allocation [eap-8.1.z] (CVE-2026-14682)
• bcprov-jdk18on: Bouncy Castle for Java: Cryptographic key compromise due to unvalidated Diffie-Hellman peer value [eap-8.1.z] (CVE-2026-59650)
• bcprov-jdk18on: Bouncy Castle for Java: Weak integrity protection in BKS keystore [eap-8.1.z] (CVE-2026-59651)
• bcprov-jdk18on: Bouncy Castle for Java: Message Authentication Code (MAC) forgery due to a length-dependent Key Derivation Function (KDF) split [eap-8.1.z] (CVE-2026-12816)
• bcpkix-jdk18on: Bouncy Castle for Java: Certificate validation bypass via stapled OCSP response [eap-8.1.z] (CVE-2026-58062)
• bcpkix-jdk18on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI [eap-8.1.z] (CVE-2026-8763)
• netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling [eap-8.1.z] (CVE-2026-93562)
• netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line [eap-8.1.z] (CVE-2026-93566)
• netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling [eap-8.1.z] (CVE-2026-93573)
• netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing [eap-8.1.z] (CVE-2026-93574)
• netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams [eap-8.1.z] (CVE-2026-100655)
• netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams [eap-8.1.z] (CVE-2026-100655)
• netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining [eap-8.1.z] (CVE-2026-100656)
• netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodec [eap-8.1.z] (CVE-2026-100666)
• cxf-rt-ws-mex: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-databinding-jaxb: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-bindings-soap: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-transports-http: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)
• cxf-rt-frontend-jaxws: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

• JBoss Enterprise Application Platform Text-Only Advisories x86_64

Fixes

• BZ - 2478005 - CVE-2026-15564 wildfly-ejb: wildfly-iiop-openjdk: EAP IIOP listeners may permit unauthed deserialization
• BZ - 2491619 - CVE-2026-114488 Wildfly: wildfly-iiop: wildfly-ejb3: Wildfly: Authentication bypass on IIOP EJB invocations as CSIv2 ITTPrincipalName accepted without transport binding
• BZ - 2503053 - CVE-2026-56624 org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation
• BZ - 2507631 - CVE-2026-17614 wildfly-core: Path Traversal on WildFly Domain Controller
• BZ - 2507635 - CVE-2026-17615 resteasy-core: RESTeasy SourceProvider remote unauthenticated file read
• BZ - 2510188 - CVE-2026-59651 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcprov-jdk18on: Bouncy Castle for Java: Weak integrity protection in BKS keystore
• BZ - 2510198 - CVE-2026-8763 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI
• BZ - 2510203 - CVE-2026-59650 bouncycastle: Bouncy Castle for Java: Cryptographic key compromise due to unvalidated Diffie-Hellman peer value
• BZ - 2510240 - CVE-2026-58062 org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcprov-jdk15on: Bouncy Castle for Java: Certificate validation bypass via stapled OCSP response
• BZ - 2510257 - CVE-2026-13506 bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing
• BZ - 2510258 - CVE-2026-14682 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcprov-jdk18on: org.bouncycastle/bc-fips: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service due to unbounded memory allocation
• BZ - 2510259 - CVE-2026-12816 org.bouncycastle/bcprov-jdk15on: Bouncy Castle for Java: Message Authentication Code (MAC) forgery due to a length-dependent Key Derivation Function (KDF) split
• BZ - 2510260 - CVE-2026-12803 org.bouncycastle/bc-java: Bouncy Castle for Java: Authenticated Encryption Forgery Vulnerability
• BZ - 2510722 - CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
• BZ - 2511978 - CVE-2026-64958 org.apache.cxf/cxf: Apache CXF: Denial of service via many attachment headers
• BZ - 2511979 - CVE-2026-57819 Apache CXF: Apache CXF: Denial of Service via uncontrolled form parameters
• BZ - 2511981 - CVE-2026-65432 Apache CXF: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing
• BZ - 2511983 - CVE-2026-66909 org.apache.cxf/cxf: Apache CXF: Remote Code Execution via unsafe deserialization of JMS ObjectMessage
• BZ - 2511995 - CVE-2026-65583 org.apache.cxf/cxf: Apache CXF: Authentication Bypass via Crafted OIDC Self-Issued ID Tokens
• BZ - 2514537 - EMBARGOED CVE-2026-19610 wildfly-platform-mbean: wildfly-platform-mbean: RBAC sensitive attribute read bypass for platform RuntimeMxBean
• BZ - 2514568 - CVE-2026-19611 wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding
• BZ - 2517538 - CVE-2026-59903 io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite
• BZ - 2519756 - CVE-2026-89059 resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS)
• BZ - 2519775 - CVE-2026-89058 resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config
• BZ - 2519953 - CVE-2026-75595 io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
• BZ - 2527118 - CVE-2026-84375 js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing
• BZ - 2527228 - EMBARGOED CVE-2026-84725 openjdk-orb: Incomplete fix for CVE-2026-15560,unauthed class loading via IIOP in EAP
• BZ - 2528476 - CVE-2026-85634 wildfly-core: wildfly-core: Deployer RBAC role privilege escalation via path traversal in deployment name
• BZ - 2536887 - CVE-2026-93488 io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams
• BZ - 2536891 - CVE-2026-93491 io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue
• BZ - 2536932 - CVE-2026-93558 io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service
• BZ - 2536951 - CVE-2026-93562 io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling
• BZ - 2536952 - CVE-2026-93565 io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte
• BZ - 2536954 - CVE-2026-93566 io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line
• BZ - 2536964 - CVE-2026-93573 io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling
• BZ - 2536966 - CVE-2026-93574 io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing
• BZ - 2541803 - CVE-2026-100656 io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining
• BZ - 2541863 - CVE-2026-100655 io.netty/netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams
• BZ - 2541907 - CVE-2026-100666 io.netty/netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodec
• JBEAP-35632 - (8.1.z) Upgrade BouncyCastle from 1.85 to 1.86 (resolves numerous CVEs)
• JBEAP-35651 - (8.1.z) Upgrade EAP Installer to 8.1.4.GA
• JBEAP-35658 - (8.1.z) Installer update candidate generation fails with NoClassDefFoundError: java/util/logging/Logger
• JBEAP-35795 - (8.1.z) Update EAP channel to use wildfly-ee-feature-pack-product-conf x.x.x in EAP 8.1 Update 9.1

CVEs

• CVE-2026-8763
• CVE-2026-12803
• CVE-2026-12816
• CVE-2026-13506
• CVE-2026-14682
• CVE-2026-15560
• CVE-2026-15564
• CVE-2026-17614
• CVE-2026-17615
• CVE-2026-19610
• CVE-2026-19611
• CVE-2026-56624
• CVE-2026-57819
• CVE-2026-58062
• CVE-2026-59650
• CVE-2026-59651
• CVE-2026-59903
• CVE-2026-64958
• CVE-2026-65432
• CVE-2026-65583
• CVE-2026-66909
• CVE-2026-69152
• CVE-2026-75595
• CVE-2026-84375
• CVE-2026-84725
• CVE-2026-85634
• CVE-2026-89058
• CVE-2026-89059
• CVE-2026-93488
• CVE-2026-93491
• CVE-2026-93558
• CVE-2026-93562
• CVE-2026-93565
• CVE-2026-93566
• CVE-2026-93573
• CVE-2026-93574
• CVE-2026-100655
• CVE-2026-100656
• CVE-2026-100666
• CVE-2026-114488

References

• https://access.redhat.com/security/updates/classification/#important
• https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1
• https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index
• https://access.redhat.com/articles/7148325