RHSA-2026:95887: Important: Red Hat JBoss Enterprise Application Platform 8.1.9 security update

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.Security Fix(es): netty-codec-http2: Netty: Information disclosure via CORS Vary header overwrite [eap-8.1.z] (CVE-2026-59903) netty-buffer: Netty: Information disclosure via CORS Vary header overwrite [eap-8.1.z] (CVE-2026-59903) cxf: Apache CXF: Denial of service via many attachment headers [eap-8.1.z] (CVE-2026-64958) cxf: Apache CXF: Authentication Bypass via Crafted OIDC Self-Issued ID Tokens [eap-8.1.z] (CVE-2026-65583) cxf-xjc-bug986: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-ws-security: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) jbossws-cxf-server: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-xjc-runtime: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) jbossws-cxf-resources: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-wsdl: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-services-sts-core: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-tools-java2ws: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-ws-policy: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) jbossws-cxf-client: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-tools-wsdlto-frontend-jaxws: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-tools-common: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-xjc-dv: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-services-ws-discovery-api: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-tools-wsdlto-core: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) jbossws-cxf-transports-undertow: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-tools-wsdlto-databinding-jaxb: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-ws-rm: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-xjc-boolean: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-tools-validator: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) jbossws-cxf-transports-udp: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) jbossws-cxf-factories: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-xjc-ts: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-bindings-coloc: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-features-clustering: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-transports-local: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-transports-http-hc: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-security: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-transports-jms: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-core: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-databinding-aegis: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-management: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-features-throttling: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-features-logging: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-bindings-xml: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-security-saml: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-services-sts-core: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-tools-wsdlto-frontend-jaxws: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-services-ws-discovery-api: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-tools-common: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-tools-wsdlto-databinding-jaxb: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) jbossws-cxf-factories: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-xjc-runtime: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-tools-validator: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-xjc-dv: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-xjc-boolean: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-xjc-ts: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) jbossws-cxf-resources: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-xjc-bug986: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-tools-java2ws: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) jbossws-cxf-transports-udp: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) jbossws-cxf-client: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) jbossws-cxf-transports-undertow: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) jbossws-cxf-server: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-tools-wsdlto-core: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-bindings-coloc: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-security: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-databinding-aegis: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-ws-policy: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-features-logging: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-frontend-simple: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-ws-security: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-transports-jms: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-transports-http-hc: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-transports-local: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-bindings-xml: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-transports-http: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-ws-rm: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-frontend-jaxws: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-features-clustering: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-ws-mex: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-databinding-jaxb: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-bindings-soap: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-ws-addr: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-management: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-features-throttling: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-security-saml: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-core: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-wsdl: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing [eap-8.1.z] (CVE-2026-65432) cxf-rt-frontend-simple: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-ws-addr: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) wildfly-iiop-openjdk: EAP IIOP listeners may permit unauthed deserialization [eap-8.1.z] (CVE-2026-15564) wildfly-iiop-openjdk: Wildfly: Authentication bypass on IIOP EJB invocations as CSIv2 ITTPrincipalName accepted without transport binding [eap-8.1.z] (CVE-2026-114488) brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays [eap-8.1.z] (CVE-2026-69152) wildfly-deployment-repository: Path Traversal on WildFly Domain Controller [eap-8.1.z] (CVE-2026-17614) sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation [eap-8.1.z] (CVE-2026-56624) resteasy-core: RESTeasy SourceProvider remote unauthenticated file read [eap-8.1.z] (CVE-2026-17615) wildfly-platform-mbean: wildfly-platform-mbean: RBAC sensitive attribute read bypass for platform RuntimeMxBean [eap-8.1.z] (CVE-2026-19610) cxf-rt-transports-jms: Apache CXF: Remote Code Execution via unsafe deserialization of JMS ObjectMessage [eap-8.1.z] (CVE-2026-66909) wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding [eap-8.1.z] (CVE-2026-19611) jboss-eap-runtime-maven-repository.zip: js-yaml: Denial of Service vulnerability in YAML parsing [eap-8.1.z] (CVE-2026-84375) openjdk-orb: Incomplete fix for CVE-2026-15560,unauthed class loading via IIOP in EAP [eap-8.1.z] (CVE-2026-84725) wildfly-server: wildfly-core: Deployer RBAC role privilege escalation via path traversal in deployment name [eap-8.1.z] (CVE-2026-85634) resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) [eap-8.1.z] (CVE-2026-89059) netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams [eap-8.1.z] (CVE-2026-93488) resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config [eap-8.1.z] (CVE-2026-89058) netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue [eap-8.1.z] (CVE-2026-93491) netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service [eap-8.1.z] (CVE-2026-93558) netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte [eap-8.1.z] (CVE-2026-93565) netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext [eap-8.1.z] (CVE-2026-75595) bcprov-jdk18on: Bouncy Castle for Java: Authenticated Encryption Forgery Vulnerability [eap-8.1.z] (CVE-2026-12803) bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing [eap-8.1.z] (CVE-2026-13506) bcprov-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded memory allocation [eap-8.1.z] (CVE-2026-14682) bcprov-jdk18on: Bouncy Castle for Java: Cryptographic key compromise due to unvalidated Diffie-Hellman peer value [eap-8.1.z] (CVE-2026-59650) bcprov-jdk18on: Bouncy Castle for Java: Weak integrity protection in BKS keystore [eap-8.1.z] (CVE-2026-59651) bcprov-jdk18on: Bouncy Castle for Java: Message Authentication Code (MAC) forgery due to a length-dependent Key Derivation Function (KDF) split [eap-8.1.z] (CVE-2026-12816) bcpkix-jdk18on: Bouncy Castle for Java: Certificate validation bypass via stapled OCSP response [eap-8.1.z] (CVE-2026-58062) bcpkix-jdk18on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI [eap-8.1.z] (CVE-2026-8763) netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling [eap-8.1.z] (CVE-2026-93562) netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line [eap-8.1.z] (CVE-2026-93566) netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling [eap-8.1.z] (CVE-2026-93573) netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing [eap-8.1.z] (CVE-2026-93574) netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams [eap-8.1.z] (CVE-2026-100655) netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams [eap-8.1.z] (CVE-2026-100655) netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining [eap-8.1.z] (CVE-2026-100656) netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodec [eap-8.1.z] (CVE-2026-100666) cxf-rt-ws-mex: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-databinding-jaxb: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-bindings-soap: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-transports-http: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) cxf-rt-frontend-jaxws: Apache CXF: Denial of Service via uncontrolled form parameters [eap-8.1.z] (CVE-2026-57819) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat