WildFly Elytron password implementations (wildfly-elytron-password-impl, all supported versions reported) apply Unicode Normalization Form KC (NFKC) in AbstractPasswordImpl.getNormalizedPasswordBytes() before hashing and verification (BCrypt, SCRAM, Unix crypts, and related). NFKC compatibility mapping collapses fullwidth Latin characters (e.g. U+FF01–U+FF5E) to their ASCII equivalents, so a password the user believed contained non-ASCII fullwidth characters is stored and verified as the ASCII form. An attacker can therefore match such passwords with an ASCII-only dictionary. This is older SASLprep-style processing; modern PRECIS OpaqueString (RFC 8265) uses NFC and does not width-map passwords. CWE-173.

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A remote attacker who has obtained the slave host controller secret or compromised a slave host controller can supply a crafted relative path containing directory traversal sequences (e.g., ../../etc/passwd) via the slave-DC wire protocol, causing the Domain Controller to resolve and serve arbitrary files readable by the DC process. This leads to unauthorized disclosure of sensitive information such as configuration files, keystores, and system credentials.

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.6 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.5, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.6 Release Notes for information about the most significant bug fixes and enhancements included in this release.Security Fix(es): bcpg-fips: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505) bcpkix-fips: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588) bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636) bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813) bcprov-jdk12: private key leakage via non-constant time comparisons (CVE-2026-5598) netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871) netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values (CVE-2026-33870) artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication (CVE-2026-27446) org.hibernate.orm/hibernate-c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects (CVE-2026-27830) org.keycloak-keycloak-parent: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904) mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects (CVE-2026-27727) io.hawt-project: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI (CVE-2025-23368) plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.

A remote user authenticated as ‘deployer’ account can import and deploy a malicious archive file from an untrusted source outside the intended control environment. In this specific case, the attacker leveraged WildFly (open source) libraries to craft a Java project that enabled them to perform an HTTP POST request to upload and deploy the malicious archive file from the untrusted source. In this particular scenario, the archive file is a WAR that contains a “read.jsp” page. Once the attacker uploads this file, they can leverage it to exploit other vulnerabilities, such as Arbitrary File Read, as dimostrated in this case.

Impact

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

Patches

The default behaviour has been changed in WildFly Core 31.0.3.Final, and 32.0.0.Beta3 - the first version is used by WildFly 39.0.1.Final and the second will be included in WildFly 40.

Workarounds

No direct workaround. Monitoring network traffic / blocking suspicious traffic may help.

References

https://www.cve.org/CVERecord?id=CVE-2025-23368 https://issues.redhat.com/browse/WFCORE-7192

Acknowledgements

We would like to thank Claudia Bartolini (TIM S.p.A), Marco Ventura (TIM S.p.A), and Massimiliano Brolli (TIM S.p.A) for reporting this issue.

Wildfly does not neutralize or incorrectly neutralizes user- controllable input before it is placed in output that is used as a web page that is served to other users.

A vulnerability was found in Wildfly. A user may perform cross-site scripting in Wildfly deployment system. An attacker (or insider) may execute a deploy with a malicious payload which could trigger an undesired behavior against the server.

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.

A vulnerability was found in Wildfly, where there is a possibility of potential memory leak when using OpenTracing API's java-interceptors which may eventually lead to unavailability of the services.

A vulnerability was found in Wildfly's EJB Client, where accumulation of some specific EJB transaction objects in InvocationTracker may lead to DoS.

It was found that the OpenSSL security provider does not honor TLS version in 'enabled-protocols' value of Wildfly's legacy security configuration. An attacker could target traffic sent over a TLS connection with a weaker version of TLS and potentially break the encryption of the data stream.

DISPUTED An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default (auto-deployment) permits an anonymous user to deploy a malicious .war file, leading to remote code execution. NOTE: the vendor indicates that anonymous access is not available in the default installation; however, it remains optional because there are several use cases for it, including development environments and network architectures that have a proxy server for access control to the WildFly server.

It was reported that WildFly 10.0.0 Application Server/Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also Response Splitting, due to insufficient sanitisation and validation of user input before the input is used as part of a HTTP header value.

Using newline characters injected into the HTTP headers, it is possible for the malicious user to add arbitrary headers such as Set-Cookie to set arbitrary cookies, or potentially use a Location header for an open-redirect. By using two newline characters the attacker can 'split' the response (HTTP Response Splitting) and provide their own content that will be rendered to the victim user.