Vulnerability-Lookup

RHSA-2026:53645

Vulnerability from csaf_redhat - Published: 2026-08-11 16:40 - Updated: 2026-09-18 17:40

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 Security update

Severity

Important

Notes

Topic: A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.25 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.24, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.25 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * artemis-core-client: artemis messaging handlers in Red Hat EAP permit deserialization by default [eap-7.4.z] (CVE-2026-86404) * undertow-websockets-jsr: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method [eap-7.4.z] (CVE-2026-15565) * wildfly-iiop-openjdk: Wildfly: Pre-auth denial of service on the IIOP listener [eap-7.4.z] (CVE-2026-15567) * jboss-eap-7/eap74-els-openjdk8-openshift-rhel8: Jackson-databind: Denial of Service via deeply nested JSON processing [eap-7.4.z] (CVE-2026-50193) * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [eap-7.4.z] (CVE-2026-54512) * netty-codec-redis: Netty: Denial of Service via malicious Redis array header (CVE-2026-50011) * netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416) * netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays (CVE-2026-44250) * netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads (CVE-2026-44890) * netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments (CVE-2026-46340) * netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674) * netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010) * netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (CVE-2026-48006) * netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) * netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059) * netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043) * netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893) * netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing (CVE-2026-42585) * netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) * netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) * netty-codec-http: Netty: HTTP request smuggling via URI manipulation and CRLF injection (CVE-2026-41417) * netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578) * netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581) * netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion (CVE-2026-42584) * netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579) * picketlink-federation: auth bypass in Picketlink SAML unsolicited-response (CVE-2026-10579) * bcprov-jdk18on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636) * bcprov-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636) * bcprov-jdk15: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636) * bcprov-jdk12: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636) * bcpg-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505) * bcpg-jdk15on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion (CVE-2026-3505) * bcpkix-jdk18on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588) * bcpkix-jdk15on: PKIX draft CompositeVerifier accepts empty signature sequence as valid (CVE-2026-5588) * bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813) * bcprov-jdk15on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813) * bcprov-jdk15: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813) * bcprov-jdk12: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813) * bcprov-jdk15: private key leakage via non-constant time comparisons (CVE-2026-5598) * bcprov-jdk12: private key leakage via non-constant time comparisons (CVE-2026-5598) * artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication (CVE-2026-27446) * undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery (CVE-2026-15554) * wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller (CVE-2026-15555) * picketlink-federation: picketlink SAML 2.0 auth bypass via missing assertions (CVE-2026-15556) * openjdk-orb: unauthed class loading via IIOP in EAP (CVE-2026-15560) * undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow (CVE-2026-15561) * jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service (CVE-2026-15562) * wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS (CVE-2026-15563) * jsf-impl: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include (CVE-2026-46581) * netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) * jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-14813

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Affected products

Fixed 102 products

Product	Version	Remediation
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-cli-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-commons-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-core-client-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-dto-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-hornetq-protocol-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-hqclient-protocol-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-jdbc-store-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-client-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-jms-server-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-journal-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-ra-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-selector-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-server-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-service-extensions-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-activemq-artemis-tools-0:2.16.0-22.redhat_00057.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-ironjacamar-common-api-0:1.5.26-2.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-ironjacamar-common-impl-0:1.5.26-2.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-ironjacamar-common-spi-0:1.5.26-2.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-ironjacamar-core-api-0:1.5.26-2.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-ironjacamar-core-impl-0:1.5.26-2.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-ironjacamar-deployers-common-0:1.5.26-2.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-ironjacamar-jdbc-0:1.5.26-2.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-ironjacamar-validator-0:1.5.26-2.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-datatype-jdk8-0:2.18.8-1.redhat_00003.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-datatype-jsr310-0:2.18.8-1.redhat_00003.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-jaxrs-base-0:2.18.8-1.redhat_00003.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-jaxrs-json-provider-0:2.18.8-1.redhat_00003.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-module-jaxb-annotations-0:2.18.8-1.redhat_00003.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jboss-server-migration-cli-0:1.10.0-46.Final_redhat_00044.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-jboss-server-migration-core-0:1.10.0-46.Final_redhat_00044.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-all-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-buffer-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-codec-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-codec-dns-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-codec-haproxy-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-codec-http-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-codec-http2-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-codec-memcache-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-codec-mqtt-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-codec-redis-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-codec-smtp-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-codec-socks-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-codec-stomp-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-codec-xml-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-common-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-handler-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-handler-proxy-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-resolver-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-resolver-dns-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-resolver-dns-classes-macos-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-transport-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-transport-classes-epoll-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-transport-classes-kqueue-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el8eap.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-transport-native-epoll-debuginfo-0:4.1.135-1.Final_redhat_00001.1.el8eap.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-transport-native-unix-common-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-netty-transport-sctp-0:4.1.135-1.Final_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-picketlink-api-0:2.5.5-24.SP12_redhat_00016.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-picketlink-common-0:2.5.5-24.SP12_redhat_00016.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-picketlink-config-0:2.5.5-24.SP12_redhat_00016.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-picketlink-idm-api-0:2.5.5-24.SP12_redhat_00016.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-picketlink-idm-impl-0:2.5.5-24.SP12_redhat_00016.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-picketlink-idm-simple-schema-0:2.5.5-24.SP12_redhat_00016.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-picketlink-impl-0:2.5.5-24.SP12_redhat_00016.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-picketlink-wildfly8-0:2.5.5-30.SP12_redhat_00020.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-1.SP3_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-undertow-0:2.2.40-1.SP3_redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el8eap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk11-0:7.4.25-2.GA_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk17-0:7.4.25-2.GA_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-wildfly-java-jdk8-0:7.4.25-2.GA_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-wildfly-javadocs-0:7.4.25-2.GA_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-JBEAP-7.4-ELS:eap7-wildfly-modules-0:7.4.25-2.GA_redhat_00001.1.el8eap.noarch	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-0636

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `LDAPStoreHelper` implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying crafted input, potentially leading to disclosure of sensitive information or the manipulation of directory search queries.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-3505

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-5588

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-347 - Improper Verification of Cryptographic Signature

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-5598

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy to gain unauthorized access to sensitive cryptographic information.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-385 - Covert Timing Channel

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-10579

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Critical

CVE-2026-15554

the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-15555

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

8.8 (High)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-502 - Deserialization of Untrusted Data

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-15556

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE-347 - Improper Verification of Cryptographic Signature

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-15561

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-15562

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-15563

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-306 - Missing Authentication for Critical Function

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-15565

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-15567

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-27446

A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. The primary consequence is the potential for message injection into any queue and/or message exfiltration from any queue via the rogue broker.

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-306 - Missing Authentication for Critical Function

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-41417

A flaw was found in Netty. A remote attacker can bypass request-line validation by manipulating the URI after a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created. This vulnerability, a form of Carriage Return Line Feed (CRLF) injection, allows for the insertion of additional HTTP or RTSP requests. The primary consequence is HTTP request smuggling or desynchronization, which can lead to unauthorized access or manipulation of web traffic.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Moderate

CVE-2026-42578

A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-42579

A flaw was found in Netty. Netty's DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-1286 - Improper Validation of Syntactic Correctness of Input

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-42581

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.

7.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-42584

A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-42585

A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate web traffic.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Moderate

CVE-2026-42587

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-44249

A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-1287 - Improper Validation of Specified Type of Input

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-44250

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion. Consequently, this can result in a Denial of Service (DoS) condition, rendering the affected server unresponsive.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-44890

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending specially crafted Redis payloads across multiple connections without proper termination. This can exhaust the server's direct memory pool, leading to a Denial of Service (DoS) condition where legitimate connections cannot be processed.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-44893

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-805 - Buffer Access with Incorrect Length Value

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-45416

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-45674

A flaw was found in Netty's DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses, which could enable an attacker to redirect network traffic or intercept sensitive data from affected applications.

8.7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

CWE-346 - Origin Validation Error

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-46340

A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol (SCTP) message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service (DoS) condition. The affected component fails to limit the size or number of these fragments, allowing an attacker to consume excessive system resources.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-46581

A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-47691

A flaw was found in Netty's `DnsResolveContext`. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing standard bailiwick rules. Consequently, future DNS resolutions for the affected parent domain will use the poisoned cache, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.

8.7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

CWE-346 - Origin Validation Error

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-48006

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the shared memory pool. Over time, this can exhaust the available memory, causing a Denial of Service (DoS) for all Netty channels in the process.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-772 - Missing Release of Resource after Effective Lifetime

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-48043

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the `DelegatingDecompressorFrameListener` class. This resource leak could lead to an Out Of Memory Error (OOME), potentially causing a Denial of Service (DoS) by taking down the entire Java Virtual Machine (JVM).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-772 - Missing Release of Resource after Effective Lifetime

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-48059

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested `PP2_TYPE_SSL` type-length-value (TLV) records. This can lead to a memory leak, causing the underlying cumulation buffer to remain permanently pinned and potentially resulting in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1286 - Improper Validation of Syntactic Correctness of Input

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-50010

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-347 - Improper Verification of Cryptographic Signature

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-50011

A flaw was found in Netty, a network application framework. The RedisArrayAggregator component pre-allocates memory based on the declared element count in a Redis array header. A remote attacker can exploit this by sending a small, malicious Redis array header that claims a huge initial capacity, leading to excessive memory pre-allocation. This can result in a denial of service (DoS) due to resource exhaustion.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-50193

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-54512

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-502 - Deserialization of Untrusted Data

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-68494

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

CVE-2026-86404

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-502 - Deserialization of Untrusted Data

Affected products

Fixed 102 products, the same list as for CVE-2025-14813

Threats

Impact Important

References

254 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:53645	self
https://access.redhat.com/security/updates/classi…	external
https://docs.redhat.com/en/documentation/red_hat_…	external
https://docs.redhat.com/en/documentation/red_hat_…	external
https://docs.redhat.com/en/documentation/red_hat_…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2444320	external
https://bugzilla.redhat.com/show_bug.cgi?id=2458634	external
https://bugzilla.redhat.com/show_bug.cgi?id=2458635	external
https://bugzilla.redhat.com/show_bug.cgi?id=2458638	external
https://bugzilla.redhat.com/show_bug.cgi?id=2458640	external
https://bugzilla.redhat.com/show_bug.cgi?id=2458641	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467540	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477217	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477220	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477224	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477226	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477227	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477232	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477930	external
https://bugzilla.redhat.com/show_bug.cgi?id=2480325	external
https://bugzilla.redhat.com/show_bug.cgi?id=2480601	external
https://bugzilla.redhat.com/show_bug.cgi?id=2480637	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482963	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482965	external
https://bugzilla.redhat.com/show_bug.cgi?id=2483121	external
https://bugzilla.redhat.com/show_bug.cgi?id=2483131	external
https://bugzilla.redhat.com/show_bug.cgi?id=2483133	external
https://bugzilla.redhat.com/show_bug.cgi?id=2483135	external
https://bugzilla.redhat.com/show_bug.cgi?id=2483136	external
https://bugzilla.redhat.com/show_bug.cgi?id=2483138	external
https://bugzilla.redhat.com/show_bug.cgi?id=2488053	external
https://bugzilla.redhat.com/show_bug.cgi?id=2488062	external
https://bugzilla.redhat.com/show_bug.cgi?id=2488081	external
https://bugzilla.redhat.com/show_bug.cgi?id=2488383	external
https://bugzilla.redhat.com/show_bug.cgi?id=2488388	external
https://bugzilla.redhat.com/show_bug.cgi?id=2488391	external
https://bugzilla.redhat.com/show_bug.cgi?id=2488400	external
https://bugzilla.redhat.com/show_bug.cgi?id=2488413	external
https://bugzilla.redhat.com/show_bug.cgi?id=2488429	external
https://bugzilla.redhat.com/show_bug.cgi?id=2488433	external
https://bugzilla.redhat.com/show_bug.cgi?id=2488437	external
https://bugzilla.redhat.com/show_bug.cgi?id=2488439	external
https://bugzilla.redhat.com/show_bug.cgi?id=2488442	external
https://bugzilla.redhat.com/show_bug.cgi?id=2511026	external
https://issues.redhat.com/browse/JBEAP-30840	external
https://issues.redhat.com/browse/JBEAP-33515	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-14813	self
https://bugzilla.redhat.com/show_bug.cgi?id=2458640	external
https://www.cve.org/CVERecord?id=CVE-2025-14813	external
https://nvd.nist.gov/vuln/detail/CVE-2025-14813	external
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	external
https://access.redhat.com/security/cve/CVE-2026-0636	self
https://bugzilla.redhat.com/show_bug.cgi?id=2458641	external
https://www.cve.org/CVERecord?id=CVE-2026-0636	external
https://nvd.nist.gov/vuln/detail/CVE-2026-0636	external
https://github.com/bcgit/bc-java/commit/d20cdb843…	external
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	external
https://access.redhat.com/security/cve/CVE-2026-3505	self
https://bugzilla.redhat.com/show_bug.cgi?id=2458638	external
https://www.cve.org/CVERecord?id=CVE-2026-3505	external
https://nvd.nist.gov/vuln/detail/CVE-2026-3505	external
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	external
https://access.redhat.com/security/cve/CVE-2026-5588	self
https://bugzilla.redhat.com/show_bug.cgi?id=2458634	external
https://www.cve.org/CVERecord?id=CVE-2026-5588	external
https://nvd.nist.gov/vuln/detail/CVE-2026-5588	external
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	external
https://access.redhat.com/security/cve/CVE-2026-5598	self
https://bugzilla.redhat.com/show_bug.cgi?id=2458635	external
https://www.cve.org/CVERecord?id=CVE-2026-5598	external
https://nvd.nist.gov/vuln/detail/CVE-2026-5598	external
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%9…	external
https://access.redhat.com/security/cve/CVE-2026-10579	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480325	external
https://www.cve.org/CVERecord?id=CVE-2026-10579	external
https://nvd.nist.gov/vuln/detail/CVE-2026-10579	external
https://access.redhat.com/security/cve/CVE-2026-15554	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480601	external
https://www.cve.org/CVERecord?id=CVE-2026-15554	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15554	external
https://access.redhat.com/security/cve/CVE-2026-15555	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480637	external
https://www.cve.org/CVERecord?id=CVE-2026-15555	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15555	external
https://access.redhat.com/security/cve/CVE-2026-15556	self
https://bugzilla.redhat.com/show_bug.cgi?id=2483121	external
https://www.cve.org/CVERecord?id=CVE-2026-15556	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15556	external
https://access.redhat.com/security/cve/CVE-2026-15560	self
https://bugzilla.redhat.com/show_bug.cgi?id=2483131	external
https://www.cve.org/CVERecord?id=CVE-2026-15560	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15560	external
https://access.redhat.com/security/cve/CVE-2026-15561	self
https://bugzilla.redhat.com/show_bug.cgi?id=2483133	external
https://www.cve.org/CVERecord?id=CVE-2026-15561	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15561	external
https://access.redhat.com/security/cve/CVE-2026-15562	self
https://bugzilla.redhat.com/show_bug.cgi?id=2483135	external
https://www.cve.org/CVERecord?id=CVE-2026-15562	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15562	external
https://access.redhat.com/security/cve/CVE-2026-15563	self
https://bugzilla.redhat.com/show_bug.cgi?id=2483138	external
https://www.cve.org/CVERecord?id=CVE-2026-15563	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15563	external
https://access.redhat.com/security/cve/CVE-2026-15565	self
https://bugzilla.redhat.com/show_bug.cgi?id=2490628	external
https://www.cve.org/CVERecord?id=CVE-2026-15565	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15565	external
https://cwe.mitre.org/data/definitions/120.html	external
https://access.redhat.com/security/cve/CVE-2026-15567	self
https://bugzilla.redhat.com/show_bug.cgi?id=2491620	external
https://www.cve.org/CVERecord?id=CVE-2026-15567	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15567	external
https://access.redhat.com/security/cve/CVE-2026-27446	self
https://bugzilla.redhat.com/show_bug.cgi?id=2444320	external
https://www.cve.org/CVERecord?id=CVE-2026-27446	external
https://nvd.nist.gov/vuln/detail/CVE-2026-27446	external
https://lists.apache.org/thread/jwpsdc8tdxotm98od…	external
https://access.redhat.com/security/cve/CVE-2026-41417	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467540	external
https://www.cve.org/CVERecord?id=CVE-2026-41417	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41417	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-42578	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477226	external
https://www.cve.org/CVERecord?id=CVE-2026-42578	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42578	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-42579	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477217	external
https://www.cve.org/CVERecord?id=CVE-2026-42579	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42579	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-42581	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477232	external
https://www.cve.org/CVERecord?id=CVE-2026-42581	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42581	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-42584	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477224	external
https://www.cve.org/CVERecord?id=CVE-2026-42584	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42584	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-42585	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477227	external
https://www.cve.org/CVERecord?id=CVE-2026-42585	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42585	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-42587	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477220	external
https://www.cve.org/CVERecord?id=CVE-2026-42587	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42587	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-44249	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488081	external
https://www.cve.org/CVERecord?id=CVE-2026-44249	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44249	external
https://github.com/netty/netty/releases/tag/netty…	external
https://github.com/netty/netty/releases/tag/netty…	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-44250	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488062	external
https://www.cve.org/CVERecord?id=CVE-2026-44250	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44250	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-44890	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488053	external
https://www.cve.org/CVERecord?id=CVE-2026-44890	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44890	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-44893	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488383	external
https://www.cve.org/CVERecord?id=CVE-2026-44893	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44893	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-45416	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488391	external
https://www.cve.org/CVERecord?id=CVE-2026-45416	external
https://nvd.nist.gov/vuln/detail/CVE-2026-45416	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-45674	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488400	external
https://www.cve.org/CVERecord?id=CVE-2026-45674	external
https://nvd.nist.gov/vuln/detail/CVE-2026-45674	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-46340	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488388	external
https://www.cve.org/CVERecord?id=CVE-2026-46340	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46340	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-46581	self
https://bugzilla.redhat.com/show_bug.cgi?id=2483136	external
https://www.cve.org/CVERecord?id=CVE-2026-46581	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46581	external
https://access.redhat.com/security/cve/CVE-2026-47691	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488439	external
https://www.cve.org/CVERecord?id=CVE-2026-47691	external
https://nvd.nist.gov/vuln/detail/CVE-2026-47691	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-48006	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488433	external
https://www.cve.org/CVERecord?id=CVE-2026-48006	external
https://nvd.nist.gov/vuln/detail/CVE-2026-48006	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-48043	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488442	external
https://www.cve.org/CVERecord?id=CVE-2026-48043	external
https://nvd.nist.gov/vuln/detail/CVE-2026-48043	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-48059	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488437	external
https://www.cve.org/CVERecord?id=CVE-2026-48059	external
https://nvd.nist.gov/vuln/detail/CVE-2026-48059	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-50010	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488429	external
https://www.cve.org/CVERecord?id=CVE-2026-50010	external
https://nvd.nist.gov/vuln/detail/CVE-2026-50010	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-50011	self
https://bugzilla.redhat.com/show_bug.cgi?id=2488413	external
https://www.cve.org/CVERecord?id=CVE-2026-50011	external
https://nvd.nist.gov/vuln/detail/CVE-2026-50011	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/security/cve/CVE-2026-50193	self
https://bugzilla.redhat.com/show_bug.cgi?id=2491999	external
https://www.cve.org/CVERecord?id=CVE-2026-50193	external
https://nvd.nist.gov/vuln/detail/CVE-2026-50193	external
https://github.com/FasterXML/jackson-databind/com…	external
https://github.com/FasterXML/jackson-databind/iss…	external
https://github.com/FasterXML/jackson-databind/sec…	external
https://access.redhat.com/security/cve/CVE-2026-54512	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492015	external
https://www.cve.org/CVERecord?id=CVE-2026-54512	external
https://nvd.nist.gov/vuln/detail/CVE-2026-54512	external
https://github.com/FasterXML/jackson-databind/com…	external
https://github.com/FasterXML/jackson-databind/iss…	external
https://github.com/FasterXML/jackson-databind/sec…	external
https://access.redhat.com/security/cve/CVE-2026-68494	self
https://bugzilla.redhat.com/show_bug.cgi?id=2511026	external
https://www.cve.org/CVERecord?id=CVE-2026-68494	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68494	external
https://github.com/FasterXML/jackson-core/commit/…	external
https://github.com/FasterXML/jackson-core/commit/…	external
https://github.com/FasterXML/jackson-core/commit/…	external
https://github.com/FasterXML/jackson-core/pull/1611	external
https://github.com/FasterXML/jackson-core/securit…	external
https://github.com/advisories/GHSA-72hv-8253-57qq	external
https://www.cve.org/CVERecord?id=CVE-2026-18401	external
https://access.redhat.com/security/cve/CVE-2026-86404	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477930	external
https://www.cve.org/CVERecord?id=CVE-2026-86404	external
https://nvd.nist.gov/vuln/detail/CVE-2026-86404	external

JSON

To clipboard

Loading 1.9 MB of JSON…

CVE-2026-86404 (GCVE-0-2026-86404)

Vulnerability from cvelistv5 – Published: 2026-09-07 11:35 – Updated: 2026-09-17 23:39

Title

Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 14:23 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:53644	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53645	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53646	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53806	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-86404	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2477930	issue-trackingx_refsource_REDHAT

Impacted products

37 products

Vendor	Product	Version
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	Unaffected: 0:2.16.0-22.redhat_00057.1.el7eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	Unaffected: 0:2.3.14-11.SP11_redhat_00001.1.el7eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	Unaffected: 0:1.5.26-2.Final_redhat_00001.1.el7eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	Unaffected: 0:2.18.8-1.redhat_00003.1.el7eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	Unaffected: 0:5.0.31-3.SP2_redhat_00001.1.el7eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	Unaffected: 0:1.10.0-46.Final_redhat_00044.1.el7eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	Unaffected: 0:4.1.135-1.Final_redhat_00001.1.el7eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	Unaffected: 0:2.5.5-30.SP12_redhat_00020.1.el7eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	Unaffected: 0:2.5.5-24.SP12_redhat_00016.1.el7eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	Unaffected: 0:2.2.40-2.SP3_redhat_00001.1.el7eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	Unaffected: 0:7.4.25-2.GA_redhat_00001.1.el7eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8	Unaffected: 0:2.16.0-22.redhat_00057.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8	Unaffected: 0:2.3.14-11.SP11_redhat_00001.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8	Unaffected: 0:1.5.26-2.Final_redhat_00001.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8	Unaffected: 0:2.18.8-1.redhat_00003.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8	Unaffected: 0:5.0.31-3.SP2_redhat_00001.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8	Unaffected: 0:1.10.0-46.Final_redhat_00044.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8	Unaffected: 0:4.1.135-1.Final_redhat_00001.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8	Unaffected: 0:2.5.5-30.SP12_redhat_00020.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8	Unaffected: 0:2.5.5-24.SP12_redhat_00016.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8	Unaffected: 0:2.2.40-1.SP3_redhat_00001.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8	Unaffected: 0:7.4.25-2.GA_redhat_00001.1.el8eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9	Unaffected: 0:2.16.0-22.redhat_00057.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9	Unaffected: 0:2.3.14-11.SP11_redhat_00001.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9	Unaffected: 0:1.5.26-2.Final_redhat_00001.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9	Unaffected: 0:2.18.8-1.redhat_00003.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9	Unaffected: 0:5.0.31-3.SP2_redhat_00001.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9	Unaffected: 0:1.10.0-46.Final_redhat_00044.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9	Unaffected: 0:4.1.135-1.Final_redhat_00001.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9	Unaffected: 0:2.5.5-30.SP12_redhat_00020.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9	Unaffected: 0:2.5.5-24.SP12_redhat_00016.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9	Unaffected: 0:2.2.40-1.SP3_redhat_00001.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9	Unaffected: 0:7.4.25-2.GA_redhat_00001.1.el9eap , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	cpe:/a:redhat:camel_quarkus:3
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	cpe:/a:redhat:camel_spring_boot:4
Red Hat	Red Hat JBoss Enterprise Application Platform 8	cpe:/a:redhat:jboss_enterprise_application_platform:8

Date Public

2026-08-11 05:45

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86404",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T14:23:26.132092Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T14:23:36.668Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-activemq-artemis",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.16.0-22.redhat_00057.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-glassfish-jsf",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-ironjacamar",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-annotations",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-core",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-databind",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-jaxrs-providers",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-modules-base",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-modules-java8",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jboss-remoting",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jboss-server-migration",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-netty",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-netty-transport-native-epoll",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-picketlink-bindings",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-picketlink-federation",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-undertow",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-wildfly",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-activemq-artemis",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.16.0-22.redhat_00057.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-glassfish-jsf",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.3.14-11.SP11_redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-ironjacamar",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.5.26-2.Final_redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-annotations",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-core",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-databind",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-jaxrs-providers",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-modules-base",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-modules-java8",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jboss-remoting",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.0.31-3.SP2_redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jboss-server-migration",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.10.0-46.Final_redhat_00044.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-netty",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-netty-transport-native-epoll",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-picketlink-bindings",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.5.5-30.SP12_redhat_00020.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-picketlink-federation",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.5.5-24.SP12_redhat_00016.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-undertow",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.2.40-1.SP3_redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-wildfly",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:7.4.25-2.GA_redhat_00001.1.el8eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-activemq-artemis",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.16.0-22.redhat_00057.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-glassfish-jsf",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.3.14-11.SP11_redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-ironjacamar",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.5.26-2.Final_redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-annotations",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-core",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-databind",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-jaxrs-providers",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-modules-base",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jackson-modules-java8",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jboss-remoting",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.0.31-3.SP2_redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-jboss-server-migration",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.10.0-46.Final_redhat_00044.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-netty",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-netty-transport-native-epoll",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-picketlink-bindings",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.5.5-30.SP12_redhat_00020.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-picketlink-federation",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.5.5-24.SP12_redhat_00016.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-undertow",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.2.40-1.SP3_redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "eap7-wildfly",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:7.4.25-2.GA_redhat_00001.1.el9eap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:amq_broker:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "artemis-server",
          "product": "Red Hat AMQ Broker 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:camel_quarkus:3"
          ],
          "defaultStatus": "unaffected",
          "packageName": "artemis-core-client",
          "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:camel_spring_boot:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "artemis-jms-client",
          "product": "Red Hat build of Apache Camel for Spring Boot 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:camel_spring_boot:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "artemis-server",
          "product": "Red Hat build of Apache Camel for Spring Boot 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:camel_spring_boot:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "undertow-core",
          "product": "Red Hat build of Apache Camel for Spring Boot 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ],
          "defaultStatus": "affected",
          "packageName": "artemis-core-client",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ],
          "defaultStatus": "affected",
          "packageName": "artemis-jms-client",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ],
          "defaultStatus": "affected",
          "packageName": "artemis-server",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ],
          "defaultStatus": "affected",
          "packageName": "undertow-core",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ],
          "defaultStatus": "affected",
          "packageName": "wildfly-messaging-activemq-subsystem",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-08-11T05:45:33.075Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "EAP\u0027s Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T23:39:16.353Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:53644",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53644"
        },
        {
          "name": "RHSA-2026:53645",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53645"
        },
        {
          "name": "RHSA-2026:53646",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53646"
        },
        {
          "name": "RHSA-2026:53806",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:53806"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-86404"
        },
        {
          "name": "RHBZ#2477930",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477930"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-15T15:34:21.130Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-08-11T05:45:33.075Z",
          "value": "Made public."
        }
      ],
      "title": "Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default",
      "workarounds": [
        {
          "lang": "en",
          "value": "Configure a restrictive deserialization-allow-list on every pooled-connection-factory resource. For example, if your MDBs only expect to receive objects of type com.yourapp.OrderEvent, set the allow-list to \"com.yourapp\". This switches ObjectInputStreamWithClassLoader from \"allow everything\" to \"deny by default, allow only listed classes.\" With this in place, even if an attacker injects a malicious ObjectMessage through any vector, the deserialization of gadget chain classes is blocked."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-502: Deserialization of Untrusted Data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-86404",
    "datePublished": "2026-09-07T11:35:04.324Z",
    "dateReserved": "2026-09-07T11:24:28.229Z",
    "dateUpdated": "2026-09-17T23:39:16.353Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:53645

CVE-2026-86404 (GCVE-0-2026-86404)

Tags

Sightings

Nomenclature

Related by attack behaviour