A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.

JBoss EAP's IIOP (Internet Inter-ORB Protocol) subsystem processes security tokens from CORBA clients as part of the CSIv2 (Common Secure Interoperability version 2) handshake. This processing happens before any authentication — triggered by a portable interceptor (SASTargetInterceptor) that fires on every single incoming IIOP request. Two methods in CSIv2Util.java read a length field directly from the attacker-controlled network packet and immediately allocate a Java byte array of that size — with zero bounds checking:

A single unauthenticated GIOP packet with a crafted length field can cause: - OutOfMemoryError — the JVM attempts a ~2 GB heap allocation and crashes - NegativeArraySizeException — integer overflow in the length field kills the worker thread - Both outcomes are repeatable — the attacker can sustain the DoS by sending packets in a loop

original reporting:

Missing Authentication — pre-auth CosNaming write ops on iiop-openjdk :3528 (JBoss EAP)

Missing authentication on the IIOP CosNaming service: the :3528 IIOP listener's NameService accepts bind/rebind/unbind operations without any authentication, allowing an unauthenticated attacker to hijack EJB JNDI lookups by rebinding stub references to an attacker-controlled ORB (MITM for all subsequent client invocations) or to unbind critical services for denial of service. findings/jboss-eap96.md

original reporting: https://docs.google.com/document/d/1Rf4NtLudECimDNy8F9clUblm6Avx8yF/edit

DoS — ChunkReader TrailerParser unbounded HeaderMap accumulation (chunked trailer OOM) (JBoss EAP)

JBoss EAP's Undertow HTTP/1.1 chunked-transfer decoder places no size or count limits on the trailer section that follows the terminal 0\r\n chunk, and trailer bytes are not counted against the configured max-entity-size limit; a single unauthenticated TCP connection streaming an arbitrarily large trailer value drives the JVM to OutOfMemoryError, taking down all deployments on the listener — this is fully mitigated when a re-framing L7 reverse proxy (nginx, HAProxy in http-mode, ALB) sits in front, but applies to direct-edge and L4/TCP load-balanced deployments. findings/jboss-eap68.md

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.

The identified Stored XSS vulnerabilities in the JBoss EAP Management Console allow authenticated users with appropriate permissions to inject malicious scripts. These scripts can be stored and executed within the context of the application, potentially compromising other users who access the affected components.

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

Network access to any of WildFly or JBoss EAP’s exposed ports which require either HTTP or SASL authentication.

End of life: 2/5/2031, End of support: 2/5/2028, Latest version: 8.1.7

End of life: 2/5/2031, End of support: 2/5/2028, Latest version: 8.1.7

End of life: 6/30/2025, End of support: 12/31/2023, Latest version: 7.4.25

End of life: 6/30/2025, End of support: 12/31/2023, Latest version: 7.4.25

This asynchronous patch is a security update zip for the JBoss EAP XP 4.0.2 runtime distribution for use with EAP 7.4.17.Security Fix(es): jose4j: denial of service via specially crafted JWE (CVE-2023-51775) A Red Hat Security Bulletin which addresses further details about the Rapid Reset flaw is available in the References section.For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A potential directory traversal vulnerability in JBoss EAP was discovered. Initial tests determined that appending "/..;/" to a request will return the JBoss EAP welcome page from the / directory.

When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked as an error state by modcluster in httpd. The problem is that requests exceeding the max-header-size cause JBoss EAP to close the TCP connection without returning an AJP response.

A malicious user could exploit this behavior by repeatedly sending requests that exceed the max-header-size, it causes a denial-of-service attack. This is because modproxycluster marks JBoss instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding.

This is a cumulative patch release zip for the JBoss EAP XP 4.0.0 runtime distribution for use with EAP 7.4.10.Security Fix(es): protobuf-java: Textformat parsing issue leads to DoS (CVE-2022-3509) protobuf-java: Message-Type Extensions parsing issue leads to DoS (CVE-2022-3510) WildFly: possible information disclosure (CVE-2022-1278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This is a cumulative patch release zip for the JBoss EAP XP 4.0.0 runtime distribution for use with EAP 7.4.9.Security Fix(es): libksba: integer overflow to code execution (CVE-2022-47629) okhttp: information disclosure via improperly used cryptographic function (CVE-2021-0341)

These are CVE issues filed against XP2 releases that have been fixed in the underlying EAP 7.3.x base, so no changes to the EAP XP2 code base.Security Fix(es): undertow: buffer leak on incoming websocket PONG message may lead to DoS (CVE-2021-3690) undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS (CVE-2021-3597) jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170) apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 (CVE-2021-29425) wildfly-core: Invalid Sensitivity Classification of Vault Expression (CVE-2021-3644) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

These are CVE issues filed against XP1 releases that have been fixed in the underlying EAP 7.3.x base, so no changes to the EAP XP1 code base.Security Fix(es): velocity: arbitrary code execution when attacker is able to modify templates (CVE-2020-13936) bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible (CVE-2020-28052) jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client (CVE-2020-35510) undertow: Possible regression in fix for CVE-2020-10687 (CVE-2021-20220) wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client (CVE-2021-20250) netty: Information disclosure via the local system temporary directory (CVE-2021-21290) guava: local information disclosure via temporary directory created with unsafe permissions (CVE-2020-8908) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This is a cumulative patch release zip for the JBoss EAP XP 1.0.4 runtime distribution.<br>Security Fix(es):<br><li> wildfly: Potential Memory leak in Wildfly when using OpenTracing (CVE-2020-27822)</li> The errata covers delivering of security fixes in incremental Maven repository.<br>For more details about the security issue(s), including the impact, a CVSS score, and other related information, see the CVE page(s) listed in the References section.

This is an asynchronous patch for Red Hat Fuse 7.6.0 on EAP, and includes the following security fix: commons-beanutils: apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default (CVE-2019-10086) To completely fix this CVE, EAP 7.2.7 or later must be applied to the system in addition to this Fuse on EAP patch. For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

JBoss EAP has a vulnerability that allows local users who are able to execute init.d script to terminate arbitrary process on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root.

Escalation of priveleges can occur when a Domain Controller process is managing slave Host Controllers running EAP 6.2, 6.3 or 6.4.

The domain controller will not propagate its administrative RBAC configuration to those slaves, resulting in the slaves (and the servers they manage) granting administrators full administrative privileges.

The JMX console as shipped with JBoss EAP 5.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. This vulnerability allows an attacker to invoke operations on mbeans via the JMX console.