A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication.
A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1.7.1, XP 6.0.5.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Security Fix(es): memory exhaustion in io.netty:netty-codec-haproxy (CVE-2026-48059) DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-47691) DDoS in io.netty:netty-codec-http2 (CVE-2026-50560) memory exhaustion in io.netty:netty-codec-redis (CVE-2026-50011) memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44250) memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44890) IPv6 subnet filter bypass in io.netty:netty-handler (CVE-2026-44249) request smuggling in io.netty:netty-codec-http (CVE-2026-50020) memory leak in io.netty:netty-codec-haproxy (CVE-2026-44893) TLS hostname verification accidentally disabled in io.netty:netty-handler (CVE-2026-50010) DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45673) excessive memory usage from SNIHandler in io.netty:netty-handler (CVE-2026-45416) file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue (CVE-2026-45536) DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45674) memory exhaustion in io.netty:netty-transport-sctp (CVE-2026-46340) denial of service in io.netty:netty-codec-http2 (CVE-2026-47244) memory exhaustion in io.netty:netty-codec-redis (CVE-2026-48006) memory exhaustion in io.netty:netty-codec-http2 (CVE-2026-48043) netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: Red Hat JBoss Enterprise Application Platform 8.1.7 security update
Moderate: Red Hat JBoss Enterprise Application Platform 8.1.7 XP 6.0.5.GA release
Moderate: Red Hat JBoss Enterprise Application Platform 8.1.7 security update
Moderate: Red Hat JBoss Enterprise Application Platform 8.1.7 security update
Moderate: Red Hat JBoss Enterprise Application Platform 8.1.7 security update
Important: Red Hat JBoss Enterprise Application Platform 8.1.6 security update
Important: Red Hat JBoss Enterprise Application Platform 8.1.6 security update
Important: Red Hat JBoss Enterprise Application Platform 7.4.24 security update
Important: Red Hat JBoss Enterprise Application Platform 7.4.24 security update
Moderate: Red Hat JBoss Enterprise Application Platform 8.1.5 XP 6.0.3.GA release
Important: Red Hat JBoss Enterprise Application Platform 8.1.5 update
Important: Red Hat JBoss Enterprise Application Platform 8.0.12 security update
Important: Red Hat JBoss Enterprise Application Platform 8.0.12 security update
Important: JBoss EAP XP 5.0 Update 4.0 release. See references for release notes.
Important: Red Hat JBoss Enterprise Application Platform 8.1.4 XP 6.0.2.GA release
Important: Red Hat JBoss Enterprise Application Platform 8.1.4 security update
Important: Red Hat JBoss Enterprise Application Platform 8.1.3 security update
Important: Red Hat JBoss Enterprise Application Platform 8.1.3 security update
Important: Red Hat JBoss Enterprise Application Platform 8.1.3 security update
Moderate: Red Hat JBoss Enterprise Application Platform 8.0.11 security update
Moderate: Red Hat JBoss Enterprise Application Platform 8.0.11 security update
Moderate: Red Hat JBoss Enterprise Application Platform 8.0.11 security update
Moderate: Red Hat JBoss Enterprise Application Platform 8.1.2 Security update
Moderate: Red Hat JBoss Enterprise Application Platform 8.1.2 security update
For an AJP 400 response, EAP 7 is improperly sending two response packets and those 'END RESPONSE' packets have the reuse flag set even though JBoss does close the connection. So when httpd reuses that connection after a 400 for something like a cping, it will receive a failure since it reads in the second SENDHEADERS response packet instead of a CPONG.
Important: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.This release of Red Hat JBoss Enterprise Application Platform 7.4.5 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.4 and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.5 Release Notes for information about the most significant bug fixes and enhancements included in this release.Security Fix(es): h2: Loading of custom classes from remote servers through JNDI (CVE-2022-23221) jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518) netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136) netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137) h2: Remote Code Execution in Console (CVE-2021-42392) netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797) xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084) wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled (CVE-2022-0866) undertow: Double AJP response for 400 from EAP 7 results in CPING failures (CVE-2022-1319) OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646) (CVE-2022-21299) mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors (CVE-2022-21363) xerces-j2: infinite loop when handling specially crafted XML document payloads (CVE-2022-23437) artemis-commons: Apache ActiveMQ Artemis DoS (CVE-2022-23913) Moment.js: Path traversal in moment.locale (CVE-2022-24785) jboss-client: memory leakage in remote client transaction (CVE-2022-0853) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime.This release of Red Hat JBoss Enterprise Application Platform 7.4.4 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.3 and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.4 Release Notes for information about the most significant bug fixes and enhancements included in this release.Security Fix(es): log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305) log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307) log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104) log4j-core: remote code execution via JDBC Appender (CVE-2021-44832) log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) (CVE-2021-45046) log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern (CVE-2021-45105) log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.