RHSA-2026:95221: Important: Red Hat JBoss Enterprise Application Platform 8.1.9 XP 6.0.7.GA release

This is a cumulative patch release zip for the JBoss EAP XP 6.0.7 runtime distribution for use with EAP 8.1.9Security Fix(es): netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) [eapxp-6] (CVE-2026-93579) netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority [eapxp-6] (CVE-2026-93569) netty-codec-http2: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests [eapxp-6] (CVE-2026-93568) netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority [eapxp-6] (CVE-2026-93567) netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size [eapxp-6] (CVE-2026-93492) netty-codec-http2: Netty: Information disclosure via CORS Vary header overwrite [eapxp-6] (CVE-2026-59903) netty-buffer: Netty: Information disclosure via CORS Vary header overwrite [eapxp-6] (CVE-2026-59903) parent: Apache ZooKeeper: Operational log forgery via newline injection [eapxp-6] (CVE-2026-84501) zookeeper: Apache ZooKeeper: Operational log forgery via newline injection [eapxp-6] (CVE-2026-84501) parent: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [eapxp-6] (CVE-2026-59969) zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise [eapxp-6] (CVE-2026-59969) resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config [eapxp-6] (CVE-2026-89058) resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) [eapxp-6] (CVE-2026-89059) zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing [eapxp-6] (CVE-2026-90852) zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress [eapxp-6] (CVE-2026-90560) jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing [eapxp-6] (CVE-2026-68497) zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read [eapxp-6] (CVE-2026-89046) zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect [eapxp-6] (CVE-2026-87824) zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service [eapxp-6] (CVE-2026-87795) zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service [eapxp-6] (CVE-2026-87877) zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability [eapxp-6] (CVE-2026-87825) micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing [eapxp-6] (CVE-2026-59296) proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching [eapxp-6] (CVE-2026-66257) proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation [eapxp-6] (CVE-2026-66273) resteasy-core: RESTeasy SourceProvider remote unauthenticated file read [eapxp-6] (CVE-2026-17615) proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting [eapxp-6] (CVE-2026-66274)

— Red Hat