RHSA-2026:50085: Important: Red Hat JBoss Enterprise Application Platform 8.1.7.1 XP 6.0.5.1 release
A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1.7.1, XP 6.0.5.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Security Fix(es): memory exhaustion in io.netty:netty-codec-haproxy (CVE-2026-48059) DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-47691) DDoS in io.netty:netty-codec-http2 (CVE-2026-50560) memory exhaustion in io.netty:netty-codec-redis (CVE-2026-50011) memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44250) memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44890) IPv6 subnet filter bypass in io.netty:netty-handler (CVE-2026-44249) request smuggling in io.netty:netty-codec-http (CVE-2026-50020) memory leak in io.netty:netty-codec-haproxy (CVE-2026-44893) TLS hostname verification accidentally disabled in io.netty:netty-handler (CVE-2026-50010) DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45673) excessive memory usage from SNIHandler in io.netty:netty-handler (CVE-2026-45416) file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue (CVE-2026-45536) DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45674) memory exhaustion in io.netty:netty-transport-sctp (CVE-2026-46340) denial of service in io.netty:netty-codec-http2 (CVE-2026-47244) memory exhaustion in io.netty:netty-codec-redis (CVE-2026-48006) memory exhaustion in io.netty:netty-codec-http2 (CVE-2026-48043) netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Other sources
Important: Red Hat JBoss Enterprise Application Platform 8.1.7.1 XP 6.0.5.1 release
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:netty-codec-haproxyto a version that resolves this vulnerability.Patch CVE-2026-48059 - Upgrade
Upgrade
Red Hat JBoss Enterprise Application Platformto a version that resolves this vulnerability.Fixed in 8.1.7.1 - Upgrade
Upgrade
Red Hat JBoss Enterprise Application Platformto a version that resolves this vulnerability.Fixed in 6.0.5.1