RHSA-2026:99017
Vulnerability from csaf_redhat - Published: 2026-11-11 15:52 - Updated: 2026-11-11 22:40Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update
Severity
Important
Notes
Topic: A security update is now available for Red Hat JBoss Enterprise Application
Platform 8.1. Red Hat Product Security has rated this update as having a
security impact of Important. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Enterprise Application Platform 8 is a platform for Java
applications based on the WildFly application runtime.
This asynchronous patch is an update for Red Hat JBoss Enterprise Application
Platform 8.1. See Release Notes for information about the most significant bug
fixes and enhancements included in this release.
Security Fix(es):
* bcjmail-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)
* bcpg-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)
* bcutil-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)
* bcpkix-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)
* bcjmail-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645)
* bcpg-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645)
* bcutil-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645)
* bcpkix-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645)
* bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645)
* bcprov-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)
* bcjmail-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639)
* bcpg-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639)
* bcpkix-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639)
* bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639)
* bcjmail-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)
* bcpg-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)
* bcutil-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)
* bcpkix-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)
* bcprov-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)
* bcjmail-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060)
* bcpg-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060)
* bcutil-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060)
* bcpkix-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060)
* bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060)
* bcpg-jdk18on: Bouncy Castle for Java: Integrity bypass in CCM-family modes [eap-8.1.z] (CVE-2026-58061)
* bcprov-jdk18on: Bouncy Castle for Java: Integrity bypass in CCM-family modes [eap-8.1.z] (CVE-2026-58061)
* sshd-core: Apache MINA SSHD: Asynchronous authentication can bypass signature verification [eap-8.1.z] (CVE-2026-77185)
* jackson-core: jackson-core: Denial of Service via excessively long JSON property names [eap-8.1.z] (CVE-2026-68498)
* bcutil-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889)
* bcjmail-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889)
* bcpg-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889)
* bcprov-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889)
* bcpkix-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889)
* jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing [eap-8.1.z] (CVE-2026-89425)
* jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion [eap-8.1.z] (CVE-2026-91777)
* bcpg-jdk18on: Bouncy Castle: Signature misattribution via missing subkey cross-certification validation [eap-8.1.z] (CVE-2026-71887)
* sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation [eap-8.1.z] (CVE-2026-93994)
* xmlschema-core: Apache XMLSchema: Denial of Service (DoS) via deeply nested schema structures [eap-8.1.z] (CVE-2026-102496)
* xmlschema-core: Apache XMLSchema: Denial of Service via unbounded recursion during schema parsing [eap-8.1.z] (CVE-2026-102495)
* jackson-core: Jackson-core: Denial of Service via regular expression backtracking [eap-8.1.z] (CVE-2026-89407)
* neethi: Neethi: Denial of Service via crafted WS-Policy documents [eap-8.1.z] (CVE-2026-91866)
* neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents [eap-8.1.z] (CVE-2026-91865)
* neethi: Apache Neethi: Denial of Service via uncontrolled recursion in WS-Policy document parsing [eap-8.1.z] (CVE-2026-91863)
* neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents [eap-8.1.z] (CVE-2026-91864)
* wildfly-server: wildfly: RBAC bypass in WildFly deployment-operation handlers leads to privilege escalation [eap-8.1.z] (CVE-2026-12977)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to compromise the integrity of data during the decryption of Cryptographic Message Syntax (CMS) AuthEnvelopedData. The software fails to properly enforce the tag-length, which could enable an attacker to manipulate encrypted data without detection.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
|
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Bouncy Castle for Java. A remote attacker could exploit a vulnerability where the HSS public-key level count is unbounded. This allows for a huge memory allocation during the verification process, leading to a denial of service (DoS) condition. This issue affects Bouncy Castle for Java, Bouncy Castle for Java LTS, and Bouncy Castle for Java FIPS (BC-FJA).
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Bouncy Castle for Java. When using CCM-family (Counter with CBC-MAC) modes, the software writes plaintext data into a buffer before verifying the cryptographic tag. This could allow an attacker to manipulate data that is later assumed to be authentic, leading to a high integrity impact if the plaintext is processed before the tag validation completes.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Bouncy Castle for Java. The library's Cryptographic Message Syntax (CMS) component, which handles digital signature verification, incorrectly validates data that has no signers. This means that even if data is not digitally signed, the system might still consider it legitimate. This could allow an attacker to bypass critical security checks and potentially introduce unauthorized or malicious content.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to bypass cryptographic integrity checks in the Cryptographic Message Syntax (CMS) AuthenticatedData content without requiring user interaction or elevated privileges. Specifically, when authentication attributes (authAttrs) are present, the content is not properly bound to the Message Authentication Code (MAC). This could lead to a high impact on data integrity, where an attacker might be able to alter authenticated data without detection.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Bouncy Castle for Java. A remote attacker could exploit this vulnerability by providing a specially crafted self-referential IEEE 1609.2 schema to the OER (Octet Encoding Rules) parser. This can cause the parser to recurse without a depth limit, leading to resource exhaustion and a denial of service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Apache Neethi. A remote attacker could bypass the maximum number of normalized policy alternatives by crafting specific policies. This could lead to a denial of service (DoS) attack due to excessive resource consumption.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in jackson-core. When parsing JSON data from character-based inputs, the parser does not enforce configured property name length limits while reading object keys into memory. A remote, unauthenticated attacker can exploit this flaw by submitting a crafted JSON payload containing an excessively long property name. Processing such input can exhaust system memory, causing the application to crash and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Bouncy Castle. The high-level OpenPGP (Pretty Good Privacy) API fails to properly enforce cross-certification requirements when validating subkeys that omit key capability flags. A remote attacker can exploit this flaw by binding a victim's public signing key to an attacker-controlled primary key, causing verifiers to mistakenly attribute genuinely signed messages to the attacker.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Bouncy Castle. The certificate path reviewer (PKIXCertPathReviewer) fails to enforce name constraints on the end-entity certificate during validation. A remote attacker can exploit this issue by presenting a certificate that violates domain restrictions imposed by an issuing Certificate Authority (CA). Applications that rely on the reviewer to determine trust may incorrectly accept unauthorized certificates as valid.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Apache MINA SSHD. When a Secure Shell (SSH) server implements the asynchronous authentication feature, a logic error in signature verification can result in public-key or host-based authentication checks being skipped. A remote, unauthenticated attacker can exploit this flaw to bypass authentication and gain unauthorized access to the server.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service (ReDoS) vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber() method's PATTERN_FLOAT regular expression. A small number of concurrent requests with a long input string can exhaust a server's request-handling thread pool, leading to a Denial of Service (DoS).
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Moderate
A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted, malformed token to the JsonFactory.createParser(DataInput) method. The UTF8DataInputJsonParser component, responsible for handling DataInput sources, does not properly limit the size of the error message generated for invalid tokens. This unbounded growth of the StringBuilder can consume excessive memory, leading to an OutOfMemoryError and crashing the Java Virtual Machine (JVM).
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing of forward-references, where the system performs a quadratic amount of work for linearly growing input, leading to excessive CPU consumption.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by sending a specially crafted WS-Policy document containing deeply nested policy elements. This crafted document can bypass the parser's nesting-depth limit, leading to uncontrolled recursion that exhausts the thread stack. Successful exploitation results in a denial of service, causing the parser to crash.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by sending a specially crafted WS-Policy document. This document can contain unlimited content within a policy assertion, which Neethi processes without proper size limits. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by providing a specially crafted WS-Policy document containing repeated policy references. This document would force Neethi to exponentially re-expand the same references during normalization, consuming excessive CPU and memory resources. This can lead to a denial of service (DoS), making the affected system unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Neethi. A remote attacker could exploit this vulnerability by providing specially crafted WS-Policy documents. This could force Neethi's policy-intersection to perform an exponential amount of work, leading to a denial of service (DoS) by consuming excessive CPU resources.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Apache MINA SSHD. When the server is configured to require multiple Secure Shell (SSH) public keys for authentication, it fails to verify that the submitted keys are distinct. A remote user can exploit this flaw by presenting the same public key twice to satisfy multi-key authentication requirements. This flaw results in an authentication bypass, allowing an attacker to gain unauthorized access using fewer credentials than mandated by the security policy.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Apache XMLSchema. The parser does not properly restrict how deeply schema imports and includes can be nested during processing. A remote attacker could provide a crafted schema with deeply nested references, triggering unbounded recursion that exhausts the call stack. This flaw leads to an application crash, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
A flaw was found in Apache XMLSchema. When constructing its schema model, the parser does not restrict how deeply schema structures can be nested. A remote attacker could exploit this vulnerability by providing a crafted XML schema containing deeply nested elements, triggering uncontrolled recursion and a stack overflow that crashes the application, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-12802
Threats
Impact
Important
References
166 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A security update is now available for Red Hat JBoss Enterprise Application\nPlatform 8.1. Red Hat Product Security has rated this update as having a\nsecurity impact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Enterprise Application Platform 8 is a platform for Java\napplications based on the WildFly application runtime.\n\nThis asynchronous patch is an update for Red Hat JBoss Enterprise Application\nPlatform 8.1. See Release Notes for information about the most significant bug\nfixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* bcjmail-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)\n\n* bcpg-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)\n\n* bcutil-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)\n\n* bcpkix-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)\n\n* bcjmail-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645)\n\n* bcpg-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645)\n\n* bcutil-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645)\n\n* bcpkix-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645)\n\n* bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [eap-8.1.z] (CVE-2026-59645)\n\n* bcprov-jdk18on: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption. [eap-8.1.z] (CVE-2026-12802)\n\n* bcjmail-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639)\n\n* bcpg-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639)\n\n* bcpkix-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639)\n\n* bcprov-jdk18on: Bouncy Castle for Java: Cryptographic signature bypass [eap-8.1.z] (CVE-2026-59639)\n\n* bcjmail-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)\n\n* bcpg-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)\n\n* bcutil-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)\n\n* bcpkix-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)\n\n* bcprov-jdk18on: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData [eap-8.1.z] (CVE-2026-59642)\n\n* bcjmail-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060)\n\n* bcpg-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060)\n\n* bcutil-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060)\n\n* bcpkix-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060)\n\n* bcprov-jdk18on: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count [eap-8.1.z] (CVE-2026-58060)\n\n* bcpg-jdk18on: Bouncy Castle for Java: Integrity bypass in CCM-family modes [eap-8.1.z] (CVE-2026-58061)\n\n* bcprov-jdk18on: Bouncy Castle for Java: Integrity bypass in CCM-family modes [eap-8.1.z] (CVE-2026-58061)\n\n* sshd-core: Apache MINA SSHD: Asynchronous authentication can bypass signature verification [eap-8.1.z] (CVE-2026-77185)\n\n* jackson-core: jackson-core: Denial of Service via excessively long JSON property names [eap-8.1.z] (CVE-2026-68498)\n\n* bcutil-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889)\n\n* bcjmail-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889)\n\n* bcpg-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889)\n\n* bcprov-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889)\n\n* bcpkix-jdk18on: Bouncy Castle: Certificate validation bypass via missing name constraint checks [eap-8.1.z] (CVE-2026-71889)\n\n* jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing [eap-8.1.z] (CVE-2026-89425)\n\n* jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion [eap-8.1.z] (CVE-2026-91777)\n\n* bcpg-jdk18on: Bouncy Castle: Signature misattribution via missing subkey cross-certification validation [eap-8.1.z] (CVE-2026-71887)\n\n* sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation [eap-8.1.z] (CVE-2026-93994)\n\n* xmlschema-core: Apache XMLSchema: Denial of Service (DoS) via deeply nested schema structures [eap-8.1.z] (CVE-2026-102496)\n\n* xmlschema-core: Apache XMLSchema: Denial of Service via unbounded recursion during schema parsing [eap-8.1.z] (CVE-2026-102495)\n\n* jackson-core: Jackson-core: Denial of Service via regular expression backtracking [eap-8.1.z] (CVE-2026-89407)\n\n* neethi: Neethi: Denial of Service via crafted WS-Policy documents [eap-8.1.z] (CVE-2026-91866)\n\n* neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents [eap-8.1.z] (CVE-2026-91865)\n\n* neethi: Apache Neethi: Denial of Service via uncontrolled recursion in WS-Policy document parsing [eap-8.1.z] (CVE-2026-91863)\n\n* neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents [eap-8.1.z] (CVE-2026-91864)\n\n* wildfly-server: wildfly: RBAC bypass in WildFly deployment-operation handlers leads to privilege escalation [eap-8.1.z] (CVE-2026-12977)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s)\nlisted in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:99017",
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2491669",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491669"
},
{
"category": "external",
"summary": "2510189",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510189"
},
{
"category": "external",
"summary": "2510197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510197"
},
{
"category": "external",
"summary": "2510204",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510204"
},
{
"category": "external",
"summary": "2510224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510224"
},
{
"category": "external",
"summary": "2510243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510243"
},
{
"category": "external",
"summary": "2510254",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510254"
},
{
"category": "external",
"summary": "2538243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538243"
},
{
"category": "external",
"summary": "2538446",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538446"
},
{
"category": "external",
"summary": "2538720",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538720"
},
{
"category": "external",
"summary": "2538975",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538975"
},
{
"category": "external",
"summary": "2539034",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539034"
},
{
"category": "external",
"summary": "2539084",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539084"
},
{
"category": "external",
"summary": "2539085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539085"
},
{
"category": "external",
"summary": "2543083",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543083"
},
{
"category": "external",
"summary": "2543086",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543086"
},
{
"category": "external",
"summary": "2543860",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543860"
},
{
"category": "external",
"summary": "2543862",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543862"
},
{
"category": "external",
"summary": "2545496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545496"
},
{
"category": "external",
"summary": "2545497",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545497"
},
{
"category": "external",
"summary": "2554486",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554486"
},
{
"category": "external",
"summary": "JBEAP-35049",
"url": "https://issues.redhat.com/browse/JBEAP-35049"
},
{
"category": "external",
"summary": "JBEAP-35159",
"url": "https://issues.redhat.com/browse/JBEAP-35159"
},
{
"category": "external",
"summary": "JBEAP-35166",
"url": "https://issues.redhat.com/browse/JBEAP-35166"
},
{
"category": "external",
"summary": "JBEAP-35262",
"url": "https://issues.redhat.com/browse/JBEAP-35262"
},
{
"category": "external",
"summary": "JBEAP-35293",
"url": "https://issues.redhat.com/browse/JBEAP-35293"
},
{
"category": "external",
"summary": "JBEAP-35309",
"url": "https://issues.redhat.com/browse/JBEAP-35309"
},
{
"category": "external",
"summary": "JBEAP-35632",
"url": "https://issues.redhat.com/browse/JBEAP-35632"
},
{
"category": "external",
"summary": "JBEAP-35651",
"url": "https://issues.redhat.com/browse/JBEAP-35651"
},
{
"category": "external",
"summary": "JBEAP-35795",
"url": "https://issues.redhat.com/browse/JBEAP-35795"
},
{
"category": "external",
"summary": "JBEAP-36088",
"url": "https://issues.redhat.com/browse/JBEAP-36088"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99017.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update",
"tracking": {
"current_release_date": "2026-11-11T22:40:28+00:00",
"generator": {
"date": "2026-11-11T22:40:28+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.5"
}
},
"id": "RHSA-2026:99017",
"initial_release_date": "2026-11-11T15:52:13+00:00",
"revision_history": [
{
"date": "2026-11-11T15:52:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-11T15:52:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-11T22:40:28+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 8.1",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 8.1",
"product_id": "Red Hat JBoss Enterprise Application Platform 8.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Enterprise Application Platform"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-12802",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-08-03T04:00:56.440793+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510254"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to compromise the integrity of data during the decryption of Cryptographic Message Syntax (CMS) AuthEnvelopedData. The software fails to properly enforce the tag-length, which could enable an attacker to manipulate encrypted data without detection.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: bcpkix-fips: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important integrity flaw in Bouncy Castle for Java, affecting components used in Red Hat products such as JBoss Fuse and Enterprise Application Platform. A remote attacker can exploit insufficient tag-length enforcement during CMS AuthEnvelopedData decryption to alter encrypted data without detection, impacting the trustworthiness of information processed by affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12802"
},
{
"category": "external",
"summary": "RHBZ#2510254",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510254"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12802",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12802"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12802",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12802"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/0fefa539e6ac5c66e1daee5a13b23d1d4769cc01",
"url": "https://github.com/bcgit/bc-java/commit/0fefa539e6ac5c66e1daee5a13b23d1d4769cc01"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12802",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-12802"
}
],
"release_date": "2026-08-03T02:48:42.672000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: bcpkix-fips: Bouncy Castle for Java: Integrity compromise due to insufficient tag-length enforcement in CMS AuthEnvelopedData decryption."
},
{
"acknowledgments": [
{
"names": [
"Kelvin Mbogo"
]
}
],
"cve": "CVE-2026-12977",
"cwe": {
"id": "CWE-267",
"name": "Privilege Defined With Unsafe Actions"
},
"discovery_date": "2026-05-26T21:41:05+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491669"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted \"Maintainer\" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.wildfly.core/wildfly-server: wildfly: RBAC bypass in WildFly deployment-operation handlers leads to privilege escalation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability as having an Important impact. While it requires existing administrative privileges (Maintainer role), it allows for a complete bypass of the RBAC framework, leading to full privilege escalation to SuperUser. This enables an attacker to perform any action on the server, including deploying malicious code or mutating audit logs.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12977"
},
{
"category": "external",
"summary": "RHBZ#2491669",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491669"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12977",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12977"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12977",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12977"
}
],
"release_date": "2026-11-09T18:23:51.637000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.wildfly.core/wildfly-server: wildfly: RBAC bypass in WildFly deployment-operation handlers leads to privilege escalation"
},
{
"cve": "CVE-2026-58060",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-03T03:02:14.791501+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510243"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. A remote attacker could exploit a vulnerability where the HSS public-key level count is unbounded. This allows for a huge memory allocation during the verification process, leading to a denial of service (DoS) condition. This issue affects Bouncy Castle for Java, Bouncy Castle for Java LTS, and Bouncy Castle for Java FIPS (BC-FJA).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bouncycastle: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: Bouncy Castle for Java is vulnerable to a denial of service due to an unbounded HSS public-key level count during verification. This flaw can lead to excessive memory allocation, impacting the availability of applications. Red Hat products utilizing Bouncy Castle for Java are affected if they process untrusted HSS public keys.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58060"
},
{
"category": "external",
"summary": "RHBZ#2510243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510243"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58060",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58060"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58060",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58060"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/311cabbb6fcead7647fec16681423a4439118276",
"url": "https://github.com/bcgit/bc-java/commit/311cabbb6fcead7647fec16681423a4439118276"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/6c9f30b3fdaa3f2140809278caebbffc55920922",
"url": "https://github.com/bcgit/bc-java/commit/6c9f30b3fdaa3f2140809278caebbffc55920922"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58060",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58060"
}
],
"release_date": "2026-08-03T02:37:43.841000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bouncycastle: Bouncy Castle for Java: Denial of Service via unbounded HSS public-key level count"
},
{
"cve": "CVE-2026-58061",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-08-03T03:01:25.268381+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510224"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. When using CCM-family (Counter with CBC-MAC) modes, the software writes plaintext data into a buffer before verifying the cryptographic tag. This could allow an attacker to manipulate data that is later assumed to be authentic, leading to a high integrity impact if the plaintext is processed before the tag validation completes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bc-java: org.bouncycastle/bc-fja: Bouncy Castle for Java: Integrity bypass in CCM-family modes",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has an Important impact. Bouncy Castle for Java\u0027s CCM-family authenticated encryption modes (Counter with CBC-MAC) write decrypted plaintext to the caller\u0027s buffer before verifying the cryptographic tag. A remote attacker can exploit this by sending manipulated ciphertext, which will be decrypted and written to the buffer. If the application processes this buffer before the tag verification completes and fails, the attacker has successfully bypassed the integrity protection, allowing manipulation of data that the application assumes is authenticated. This affects applications using CCMBlockCipher, KCCMBlockCipher, or KGCMBlockCipher modes from the Bouncy Castle crypto provider.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58061"
},
{
"category": "external",
"summary": "RHBZ#2510224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510224"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58061",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58061"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58061",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58061"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/08d675106bb663ddcc6ec0a4af6f6f62f512697b",
"url": "https://github.com/bcgit/bc-java/commit/08d675106bb663ddcc6ec0a4af6f6f62f512697b"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/cd4a5ab3ad619ff03c7767c1b8b19d5dea2970af",
"url": "https://github.com/bcgit/bc-java/commit/cd4a5ab3ad619ff03c7767c1b8b19d5dea2970af"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58061",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-58061"
}
],
"release_date": "2026-08-03T02:36:36.753000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bc-java: org.bouncycastle/bc-fja: Bouncy Castle for Java: Integrity bypass in CCM-family modes"
},
{
"cve": "CVE-2026-59639",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-08-03T02:01:21.111618+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510197"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. The library\u0027s Cryptographic Message Syntax (CMS) component, which handles digital signature verification, incorrectly validates data that has no signers. This means that even if data is not digitally signed, the system might still consider it legitimate. This could allow an attacker to bypass critical security checks and potentially introduce unauthorized or malicious content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-fips: Bouncy Castle for Java: Cryptographic signature bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Bouncy Castle for Java is bundled as a cryptographic provider across numerous Red Hat products. The CMS verifySignatures method incorrectly returns true for SignedData containing zero signers, so unsigned content may be treated as validly signed \u2014 a cryptographic signature-verification bypass with a high integrity impact. This affects applications that rely on Bouncy Castle CMS to verify signatures.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59639"
},
{
"category": "external",
"summary": "RHBZ#2510197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510197"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59639",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59639"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59639",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59639"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0",
"url": "https://github.com/bcgit/bc-java/commit/99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59639",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59639"
}
],
"release_date": "2026-08-03T00:56:24.394000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, or BC-FJA bcpkix-fips 1.0.12/2.0.12/2.1.12) once available for the affected product.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-fips: Bouncy Castle for Java: Cryptographic signature bypass"
},
{
"cve": "CVE-2026-59642",
"cwe": {
"id": "CWE-354",
"name": "Improper Validation of Integrity Check Value"
},
"discovery_date": "2026-08-03T02:01:41.463860+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510204"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to bypass cryptographic integrity checks in the Cryptographic Message Syntax (CMS) AuthenticatedData content without requiring user interaction or elevated privileges. Specifically, when authentication attributes (authAttrs) are present, the content is not properly bound to the Message Authentication Code (MAC). This could lead to a high impact on data integrity, where an attacker might be able to alter authenticated data without detection.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-fips: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Bouncy Castle for Java is bundled as a cryptographic provider by numerous Red Hat products. When CMS AuthenticatedData is processed with authentication attributes (authAttrs) present, the content is not cryptographically bound to the MAC, allowing an attacker to alter authenticated data without detection. Exploitation requires an application to process attacker-controlled CMS AuthenticatedData using the affected Bouncy Castle APIs. Affected Red Hat products consume Bouncy Castle transitively (e.g. resteasy, ceph, Keycloak/RHSSO, EAP) and are addressed via the delegated component trackers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59642"
},
{
"category": "external",
"summary": "RHBZ#2510204",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510204"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59642",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59642"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59642",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59642"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/2117f316a5a47308f3e569695a6592b16aac0dd7",
"url": "https://github.com/bcgit/bc-java/commit/2117f316a5a47308f3e569695a6592b16aac0dd7"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59642",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59642"
}
],
"release_date": "2026-08-03T00:53:28.335000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component (bc-java 1.85, LTS 2.73.12, or BC-FJA 1.0.12/2.0.12/2.1.12) once available.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-fips: Bouncy Castle for Java: Data integrity bypass due to improper cryptographic binding in CMS AuthenticatedData"
},
{
"cve": "CVE-2026-59645",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition"
},
"discovery_date": "2026-08-03T02:00:56.542858+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510189"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle for Java. A remote attacker could exploit this vulnerability by providing a specially crafted self-referential IEEE 1609.2 schema to the OER (Octet Encoding Rules) parser. This can cause the parser to recurse without a depth limit, leading to resource exhaustion and a denial of service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcutil-fips: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Bouncy Castle for Java is bundled as a cryptographic provider across numerous Red Hat products. The OER (Octet Encoding Rules) parser recurses without a depth limit on a self-referential IEEE 1609.2 schema, so a crafted schema causes resource exhaustion and a denial of service. This is reachable only via the OER / IEEE 1609.2 (V2X) code paths, a narrow surface for most products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59645"
},
{
"category": "external",
"summary": "RHBZ#2510189",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510189"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59645",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59645"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59645",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59645"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989",
"url": "https://github.com/bcgit/bc-java/commit/822b2478b131097368a56290f5728e28dd042989"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59645",
"url": "https://github.com/bcgit/bc-java/wiki/CVE-2026-59645"
}
],
"release_date": "2026-08-03T00:49:41.143000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, or BC-FJA bcutil-fips 2.0.7/2.1.7) once available for the affected product.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcutil-fips: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion"
},
{
"cve": "CVE-2026-66143",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-24T13:01:21.185148+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2506723"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Neethi. A remote attacker could bypass the maximum number of normalized policy alternatives by crafting specific policies. This could lead to a denial of service (DoS) attack due to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Neethi: Apache Neethi: Denial of Service via crafted policies",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache Neethi. It is possible to bypass the maximum number of normalized policy alternatives introduced in version 3.2.2 via certain crafted WS-Policy documents, which may lead to a denial of service attack via resource consumption.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66143"
},
{
"category": "external",
"summary": "RHBZ#2506723",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506723"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66143"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/s6o6p5pvcbcsk54dlg6j699t5gxol28w",
"url": "https://lists.apache.org/thread/s6o6p5pvcbcsk54dlg6j699t5gxol28w"
}
],
"release_date": "2026-07-24T12:07:52.657000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Update to Apache Neethi version 3.2.3 or later.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Neethi: Apache Neethi: Denial of Service via crafted policies"
},
{
"cve": "CVE-2026-68498",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-16T21:23:39.430928+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2554486"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. When parsing JSON data from character-based inputs, the parser does not enforce configured property name length limits while reading object keys into memory. A remote, unauthenticated attacker can exploit this flaw by submitting a crafted JSON payload containing an excessively long property name. Processing such input can exhaust system memory, causing the application to crash and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in jackson-core. When parsing JSON from character-based inputs (such as Reader, String, or char[]), ReaderBasedJsonParser fails to enforce the configured StreamReadConstraints.maxNameLength limit during name accumulation, validating against the larger maxStringLength limit instead. A remote, unauthenticated attacker can exploit this flaw by sending a crafted JSON object containing an excessively long property name, forcing allocations up to 100 million characters. This can cause heap exhaustion and an Out-Of-Memory application crash, resulting in a denial of service within standard process and container boundaries.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68498"
},
{
"category": "external",
"summary": "RHBZ#2554486",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554486"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68498",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68498"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68498",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68498"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x",
"url": "https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/blob/3.x/release-notes/VERSION",
"url": "https://github.com/FasterXML/jackson-core/blob/3.x/release-notes/VERSION"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/2cd206de1163e3fcff7bdaca425274f00668b075",
"url": "https://github.com/FasterXML/jackson-core/commit/2cd206de1163e3fcff7bdaca425274f00668b075"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1643",
"url": "https://github.com/FasterXML/jackson-core/pull/1643"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-649p-m576-vr99",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-649p-m576-vr99"
}
],
"release_date": "2026-10-16T21:11:03.551000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Parse untrusted JSON payloads directly from UTF-8 byte streams (e.g., InputStream or raw bytes) rather than character-based sources like String or Reader. Alternatively, configure custom StreamReadConstraints to lower maxStringLength or enforce a strict maxDocumentLength limit on custom JsonFactory instances.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce property name length limits during incremental segment accumulation in ReaderBasedJsonParser character-input parsing paths: upgrade to jackson-core 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 (or the fixed Maven/Jackson Core/Pki Deps:10.6/Jackson Core/Rhaiis/Vllm Cuda Rhel/Rhaii/Vllm Gaudi Rhel/Ansible Automation Platform 25/De Minimal Rhel/Ansible Automation Platform 27/De Supported Rhel/Ansible Automation Platform 26/De Minimal Rhel/Ansible Automation Platform 27/De Minimal Rhel/Log4J/Exploit Intelligence/Agent Client Rhel/Jackson Bom/Jboss Webserver 7/Jws70 Openjdk17 Openshift Rhel/Ocp Tools 4/Jenkins Rhel/Jboss Webserver 7/Jws70 Openjdk21 Openshift Rhel/Offline Knowledge Portal/Rhokp Rhel/Rhoai/Odh Vllm Gaudi Rhel/Rhoai/Odh Trustyai Service Rhel/Rhoai/Odh Spark Operator Rhel/Rhoai/Odh Modelmesh Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhbk/Keycloak Rhel/Rhbk/Keycloak Rhel9 Operator/Rhelai3/Bootc Gaudi Rhel/Devspaces/Openvsx Rhel/Devspaces/Pluginregistry Rhel/Devspaces/Multicluster Redirector Rhel/Devspaces/Server Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Ddb Streams Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sns Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Log Sink Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws S3 Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Aws Sqs Source Rhel/Openshift Serverless 1/Kn Eventing Integrations Timer Source Rhel/Cloudservices/Insights Rbi Events/Cloudservices/Kafka Relations Sink/Cloudservices/Insights Rbi Rest/Cloudservices/Rhsm Auto Registration Listener/Cloudservices/Notifications Backend/Cloudservices/Notifications Gw/Cloudservices/Swatch Producer Azure/Cloudservices/Swatch Contracts/Cloudservices/Swatch Producer Aws/Cloudservices/Swatch Utilization/Cloudservices/Swatch Metrics builds), which track accumulated name length in _parseName2() and _handleOddName2() and invoke validateNameLength() when a buffer segment fills, closing all 2 injection vectors (crafted JSON payload with excessively long object property name, concurrent requests with oversized JSON keys targeting character-based parsers). Until patched, this is a concern on applications parsing untrusted JSON from character-based sources such as String, Reader, or char[], so parse untrusted JSON directly from UTF-8 byte streams such as InputStream rather than character sources, or configure custom StreamReadConstraints to lower maxStringLength and enforce maxDocumentLength. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI thresholds to detect rapid memory spikes prior to process termination, set ulimit or prlimit process resource limits to constrain address space consumption caused by oversized property name buffering, apply cgroups v2 resource limits to contain the blast radius of JVM heap exhaustion to the affected container or process group, and throttle client request rates and connection volume to impede concurrent transmissions of oversized JSON keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory buffering defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names"
},
{
"cve": "CVE-2026-71887",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-03T08:51:03.145315+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle. The high-level OpenPGP (Pretty Good Privacy) API fails to properly enforce cross-certification requirements when validating subkeys that omit key capability flags. A remote attacker can exploit this flaw by binding a victim\u0027s public signing key to an attacker-controlled primary key, causing verifiers to mistakenly attribute genuinely signed messages to the attacker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bcpg-jdk18on: org.bouncycastle/bcpg-jdk15to18: Bouncy Castle: Signature misattribution via missing subkey cross-certification validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as having an Important severity rating because remote actors can induce relying services to misattribute authentic digital signatures to an arbitrary identity without requiring credentials or private key compromise. Applications utilizing Bouncy Castle\u0027s high-level OpenPGP verification mechanisms may validate a re-bound signing subkey as trusted under an attacker-specified certificate. While this flaw does not permit forging arbitrary signatures or exposing private keys, downstream systems relying on signature identity assertions suffer significant integrity compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-71887"
},
{
"category": "external",
"summary": "RHBZ#2545496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-71887",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-71887"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71887",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71887"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/b51452fa48ccb578fc16b8222fce9eedf92c94d6",
"url": "https://github.com/bcgit/bc-java/commit/b51452fa48ccb578fc16b8222fce9eedf92c94d6"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071887",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071887"
}
],
"release_date": "2026-10-03T08:39:07.997000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bcpg-jdk18on: org.bouncycastle/bcpg-jdk15to18: Bouncy Castle: Signature misattribution via missing subkey cross-certification validation"
},
{
"cve": "CVE-2026-71889",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-03T08:51:06.504776+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2545497"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Bouncy Castle. The certificate path reviewer (PKIXCertPathReviewer) fails to enforce name constraints on the end-entity certificate during validation. A remote attacker can exploit this issue by presenting a certificate that violates domain restrictions imposed by an issuing Certificate Authority (CA). Applications that rely on the reviewer to determine trust may incorrectly accept unauthorized certificates as valid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-lts8on: bouncycastle: Bouncy Castle: Certificate validation bypass via missing name constraint checks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Bouncy Castle\u0027s PKIXCertPathReviewer, where X.509 name constraints are not evaluated against the end-entity certificate during path validation. An attacker can exploit this by presenting a certificate chain with a leaf certificate violating domain or subtree restrictions set by an issuing Certificate Authority. If an application relies on PKIXCertPathReviewer rather than standard CertPathValidator to determine trust decisions, it may accept unauthorized or spoofed certificates as valid, bypassing intended certificate-based authentication and integrity controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-71889"
},
{
"category": "external",
"summary": "RHBZ#2545497",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545497"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-71889",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-71889"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71889",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71889"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/commit/06dcff2f51037095de126986285c998e3455ab85",
"url": "https://github.com/bcgit/bc-java/commit/06dcff2f51037095de126986285c998e3455ab85"
},
{
"category": "external",
"summary": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071889",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9071889"
}
],
"release_date": "2026-10-03T08:31:01.178000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Do not use PKIXCertPathReviewer for trust or path validation decisions. Instead, validate certificate paths using the standard Java Cryptography Architecture via CertPathValidator.getInstance(\"PKIX\", \"BC\")",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-lts8on: bouncycastle: Bouncy Castle: Certificate validation bypass via missing name constraint checks"
},
{
"cve": "CVE-2026-77185",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2026-09-30T10:02:38.250216+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543860"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD. When a Secure Shell (SSH) server implements the asynchronous authentication feature, a logic error in signature verification can result in public-key or host-based authentication checks being skipped. A remote, unauthenticated attacker can exploit this flaw to bypass authentication and gain unauthorized access to the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Asynchronous authentication can bypass signature verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Important rather than the upstream Critical severity because exploitation requires the SSH server to have been explicitly implemented using the \"asynchronous authentication\" mechanism in Apache MINA SSHD - a feature the upstream advisory itself describes as \"presumed rare\". Since this is a specialized, opt-in configuration that the attacker cannot control, Red Hat has adjusted the CVSS Attack Complexity (AC) from Low to High.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77185"
},
{
"category": "external",
"summary": "RHBZ#2543860",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543860"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77185",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77185"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77185",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77185"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread.html/t8pn812yq8ndokxyfxztg8tovov1284n",
"url": "https://lists.apache.org/thread.html/t8pn812yq8ndokxyfxztg8tovov1284n"
}
],
"release_date": "2026-09-30T09:47:03.852000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Asynchronous authentication can bypass signature verification"
},
{
"cve": "CVE-2026-89407",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-09-22T20:07:47.987231+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538720"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service (ReDoS) vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber() method\u0027s PATTERN_FLOAT regular expression. A small number of concurrent requests with a long input string can exhaust a server\u0027s request-handling thread pool, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact because while remote actors can induce CPU starvation to trigger a denial of service, the issue affects availability only without granting unauthorized access or data tampering capabilities. In Red Hat environments, exposure depends on services deserializing untrusted JSON payloads into numeric Java object types where default string coercion occurs. Older releases packaging jackson-core versions prior to 2.17.0 do not include the vulnerable pattern matching logic and are unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89407"
},
{
"category": "external",
"summary": "RHBZ#2538720",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538720"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89407",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89407"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89407",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89407"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/issues/1649",
"url": "https://github.com/FasterXML/jackson-core/issues/1649"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1650",
"url": "https://github.com/FasterXML/jackson-core/pull/1650"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1701",
"url": "https://github.com/FasterXML/jackson-core/pull/1701"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89"
}
],
"release_date": "2026-09-22T14:53:20.999000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking"
},
{
"cve": "CVE-2026-89425",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-09-23T02:30:57.997196+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539084"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted, malformed token to the JsonFactory.createParser(DataInput) method. The UTF8DataInputJsonParser component, responsible for handling DataInput sources, does not properly limit the size of the error message generated for invalid tokens. This unbounded growth of the StringBuilder can consume excessive memory, leading to an OutOfMemoryError and crashing the Java Virtual Machine (JVM).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A denial of service flaw exists in FasterXML jackson-core where processing malformed JSON tokens from a DataInput source can lead to unbounded memory allocation. This vulnerability can exhaust system resources, causing a Java Virtual Machine (JVM) crash and impacting the availability of services that utilize the affected JsonFactory.createParser(DataInput) method with untrusted input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89425"
},
{
"category": "external",
"summary": "RHBZ#2539084",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539084"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1698",
"url": "https://github.com/FasterXML/jackson-core/pull/1698"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf"
}
],
"release_date": "2026-09-23T02:06:10.571000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing"
},
{
"cve": "CVE-2026-91777",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-09-23T02:31:01.024251+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539085"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing of forward-references, where the system performs a quadratic amount of work for linearly growing input, leading to excessive CPU consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in jackson-databind. Forward-reference completion for `@JsonIdentityInfo` object IDs in `CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()` and the equivalent implementation in `MapDeserializer` performs a linear scan of the pending-reference accumulator for every resolved ID.\n\nWhen a document creates unresolved object-ID references in an identity-enabled collection or map and then defines those IDs in reverse order, completion performs quadratic CPU work, allowing an attacker to cause a Denial of Service by sending specially crafted JSON input.\n\nExploitation requires an application that deserializes attacker-influenced JSON into an `@JsonIdentityInfo`-annotated collection or map.\n\nThe fix replaces the repeated linear lookup with a keyed pending-reference structure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91777"
},
{
"category": "external",
"summary": "RHBZ#2539085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91777",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91777"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/issues/6204",
"url": "https://github.com/FasterXML/jackson-databind/issues/6204"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"
}
],
"release_date": "2026-09-23T02:21:48.323000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Upgrade to a patched version. Refer to the advisory for the patched versions: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24.\n\nExample `pom.xml`:\n```\n\u003cdependency\u003e\n \u003cgroupId\u003ecom.fasterxml.jackson.core\u003c/groupId\u003e\n \u003cartifactId\u003ejackson-databind\u003c/artifactId\u003e\n \u003cversion\u003e2.18.11\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\nVerify: `mvn dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind`\n\nIf you cannot upgrade directly, apply defense-in-depth mitigations:\n- Restrict JSON request size\n- Audit and remove unnecessary @JsonIdentityInfo",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion"
},
{
"cve": "CVE-2026-91863",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition"
},
"discovery_date": "2026-09-22T18:33:58.750391+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538446"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by sending a specially crafted WS-Policy document containing deeply nested policy elements. This crafted document can bypass the parser\u0027s nesting-depth limit, leading to uncontrolled recursion that exhausts the thread stack. Successful exploitation results in a denial of service, causing the parser to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.neethi/neethi: Apache Neethi: Denial of Service via uncontrolled recursion in WS-Policy document parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An availability-only denial of service flaw rated IMPORTANT (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) was found in Apache Neethi, a WS-Policy parsing library shipped in Red Hat middleware products including Red Hat JBoss Enterprise Application Platform, Red Hat build of Apache Camel, Red Hat Single Sign-On, and Red Hat JBoss Fuse. A remote, unauthenticated attacker, without requiring any user interaction, could send a specially crafted WS-Policy document containing deeply nested policy elements that bypasses the parser\u0027s nesting-depth limit. The resulting uncontrolled recursion exhausts the thread stack and crashes the parser, causing a denial of service. Confidentiality and integrity are not impacted. Red Hat is handling the affected product streams under delegated resolution: for actively maintained streams a fix is being pursued, streams in which the vulnerable code is not in the execute path or the component is not present were determined not to be affected, and for older maintenance-phase streams a fix will not be provided.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91863"
},
{
"category": "external",
"summary": "RHBZ#2538446",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538446"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91863",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91863"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91863",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91863"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/09/18/10",
"url": "http://www.openwall.com/lists/oss-security/2026/09/18/10"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/72kxj71lvrqqx90xxqqctvpbw0t8mpxw",
"url": "https://lists.apache.org/thread/72kxj71lvrqqx90xxqqctvpbw0t8mpxw"
}
],
"release_date": "2026-09-21T11:25:26.648000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Apache Neethi project has addressed this issue in version 3.2.4; users of affected Red Hat products should apply updated product releases containing the fixed component through their standard update channels when they become available.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.neethi/neethi: Apache Neethi: Denial of Service via uncontrolled recursion in WS-Policy document parsing"
},
{
"cve": "CVE-2026-91864",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-22T21:59:48.365957+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539034"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by sending a specially crafted WS-Policy document. This document can contain unlimited content within a policy assertion, which Neethi processes without proper size limits. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.neethi/neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache Neethi, a WS-Policy processing library shipped in several Red Hat middleware products, including Red Hat JBoss Enterprise Application Platform, Red Hat Single Sign-On, the Red Hat build of Apache Camel, and Red Hat JBoss Fuse. Red Hat rates this flaw as IMPORTANT. A remote, unauthenticated attacker could send a specially crafted WS-Policy document that places unlimited content inside a policy assertion; Neethi copies that content into memory without counting it against its size limits, which can exhaust the Java heap and cause a denial of service of the affected application. Confidentiality and integrity are not impacted. The Red Hat CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), matching the upstream and CISA ratings, so there is no meaningful difference from upstream severity. Fixes are being pursued with the responsible engineering teams under delegated resolution for products where the vulnerable code is present and reachable; some older maintenance streams have been assessed as won\u0027t-fix. For streams where the delegated assessment determined that the vulnerable code is not in an execute path (Red Hat JBoss Fuse 7 ELS) or that the component is not present (JBoss EAP XP), those products are not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91864"
},
{
"category": "external",
"summary": "RHBZ#2539034",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539034"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91864",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91864"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91864",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91864"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/09/18/11",
"url": "http://www.openwall.com/lists/oss-security/2026/09/18/11"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/400kbynbyhqhsjkv1yz251jm9wdz8z69",
"url": "https://lists.apache.org/thread/400kbynbyhqhsjkv1yz251jm9wdz8z69"
}
],
"release_date": "2026-09-21T11:26:20.054000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Apache Neethi project addressed this flaw in version 3.2.4.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.neethi/neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents"
},
{
"cve": "CVE-2026-91865",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs"
},
"discovery_date": "2026-09-22T21:52:37.289770+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538975"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Neethi. A remote attacker could exploit this vulnerability by providing a specially crafted WS-Policy document containing repeated policy references. This document would force Neethi to exponentially re-expand the same references during normalization, consuming excessive CPU and memory resources. This can lead to a denial of service (DoS), making the affected system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.neethi/neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache Neethi, a WS-Policy processing library included in Red Hat JBoss Enterprise Application Platform, Red Hat Single Sign-On 7, Red Hat JBoss Fuse 7, and Red Hat build of Apache Camel. Red Hat rates the impact of this flaw as IMPORTANT (CVSS 3.1 score 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), consistent with the upstream assessment. A remote, unauthenticated attacker could exploit this flaw by supplying a specially crafted WS-Policy document containing repeated policy references. During normalization, Neethi re-expands these references exponentially, consuming excessive CPU and memory resources and causing a denial of service that makes the affected system unavailable to legitimate users. Confidentiality and integrity are not impacted. For product streams where the affected component is actively maintained (JBoss EAP 8.1 and Red Hat build of Apache Camel), a fix is being pursued. The JBoss Fuse 7 stream was assessed as not affected because the vulnerable code is not in the executed path, and the EAP XP 6 stream was assessed as not affected because the component is not present. For JBoss EAP 7.4 and Red Hat Single Sign-On 7 the issue was resolved as WONTFIX, so no fix is planned for those streams and they remain exposed to this denial-of-service risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91865"
},
{
"category": "external",
"summary": "RHBZ#2538975",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538975"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91865",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91865"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91865",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91865"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/09/18/12",
"url": "http://www.openwall.com/lists/oss-security/2026/09/18/12"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/l48btqh02rlpsgf5p6r5ltqk1cb69dtc",
"url": "https://lists.apache.org/thread/l48btqh02rlpsgf5p6r5ltqk1cb69dtc"
}
],
"release_date": "2026-09-21T11:26:52.788000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Apache Neethi project has addressed this issue in version 3.2.4; users of affected Red Hat products should install product-specific updates as they become available through their respective update channels.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.neethi/neethi: Apache Neethi: Denial of Service via crafted WS-Policy documents"
},
{
"cve": "CVE-2026-91866",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-09-22T17:28:25.268206+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538243"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Neethi. A remote attacker could exploit this vulnerability by providing specially crafted WS-Policy documents. This could force Neethi\u0027s policy-intersection to perform an exponential amount of work, leading to a denial of service (DoS) by consuming excessive CPU resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Neethi: Neethi: Denial of Service via crafted WS-Policy documents",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw of IMPORTANT severity was found in Apache Neethi, a WS-Policy framework library shipped in Red Hat JBoss Fuse, Red Hat Single Sign-On 7, Red Hat JBoss Enterprise Application Platform, and Red Hat build of Apache Camel products. A remote attacker able to supply specially crafted WS-Policy documents to an application using Neethi could force its policy-intersection logic to perform an exponential amount of computational work, pinning the CPU and causing a denial of service by consuming excessive resources. No privileges, user interaction, or special attack conditions are required, and only availability is impacted; confidentiality and integrity are not affected. The Red Hat severity (IMPORTANT, CVSS 3.1 score 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is consistent with the CISA assessment of the same flaw. All currently affected Red Hat product streams are recorded as affected with resolution delegated to the responsible product teams, where a fix is being pursued for the affected versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91866"
},
{
"category": "external",
"summary": "RHBZ#2538243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538243"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91866",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91866"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91866",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91866"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/09/18/13",
"url": "http://www.openwall.com/lists/oss-security/2026/09/18/13"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/zbfxnomgvbmqchqjgc6lk5h0z76k3gh4",
"url": "https://lists.apache.org/thread/zbfxnomgvbmqchqjgc6lk5h0z76k3gh4"
}
],
"release_date": "2026-09-21T11:27:15.767000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Neethi: Neethi: Denial of Service via crafted WS-Policy documents"
},
{
"cve": "CVE-2026-93994",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-09-30T10:02:22.779472+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543862"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache MINA SSHD. When the server is configured to require multiple Secure Shell (SSH) public keys for authentication, it fails to verify that the submitted keys are distinct. A remote user can exploit this flaw by presenting the same public key twice to satisfy multi-key authentication requirements. This flaw results in an authentication bypass, allowing an attacker to gain unauthorized access using fewer credentials than mandated by the security policy.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.sshd/sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache MINA SSHD\u0027s authentication implementation in the sshd-core component. When an SSH server is configured to require multi-factor authentication using two different public keys (configured as AuthenticationMethods \"publickey,publickey\" in OpenSSH or equivalent in Apache MINA SSHD), the server does not validate that the two public keys presented during authentication are actually different. An attacker who possesses one valid SSH key authorized for an account can successfully authenticate by presenting the same key twice, bypassing the requirement for a second key. This is a partial authentication bypass that completely negates the security benefit of multi-key authentication configurations. \n \nRed Hat ships vulnerable versions of Apache MINA SSHD in JBoss EAP 7/8/XP, JBoss Fuse 7 (Extended Lifecycle Support), Red Hat SSO 7, OpenShift Tools 4.x, Red Hat build of Apache Camel (Quarkus and Spring Boot variants), and RHEL-based Java packages. Fixed version 2.20.0 is available, which addresses this issue by enforcing that two distinct public keys must be presented for multi-key authentication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93994"
},
{
"category": "external",
"summary": "RHBZ#2543862",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543862"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93994",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93994"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93994",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93994"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread.html/9t3vsm8rnvwdv9779mlg1lq2fbwojdwp",
"url": "https://lists.apache.org/thread.html/9t3vsm8rnvwdv9779mlg1lq2fbwojdwp"
}
],
"release_date": "2026-09-30T09:45:32.561000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "There is no mitigation available for this issue. Apply updates as they become available from Red Hat product teams. As a temporary workaround, if using Apache MINA SSHD with multi-key authentication configured, consider implementing additional authentication mechanisms (password, OTP) or restricting SSH access to trusted networks until patches are applied.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.sshd/sshd-core: Apache MINA SSHD: Authentication bypass via duplicate public key presentation"
},
{
"cve": "CVE-2026-102495",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-29T11:50:52.158060+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543083"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache XMLSchema. The parser does not properly restrict how deeply schema imports and includes can be nested during processing. A remote attacker could provide a crafted schema with deeply nested references, triggering unbounded recursion that exhausts the call stack. This flaw leads to an application crash, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.ws.xmlschema/xmlschema-core: Apache XMLSchema: Denial of Service via unbounded recursion during schema parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as having an Important severity because unauthenticated remote attackers can crash application runtimes by submitting crafted definitions to services parsing untrusted XML schemas. In environments such as Red Hat JBoss Fuse or Enterprise Application Platform, services that dynamically resolve nested schema dependencies can experience JVM stack exhaustion and complete denial of service. The blast radius is limited to service availability, as the issue does not permit remote code execution or unauthorized data exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102495"
},
{
"category": "external",
"summary": "RHBZ#2543083",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543083"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102495"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102495",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102495"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/l339q3oldm0cd2lph4b6f93fd07x9g6s",
"url": "https://lists.apache.org/thread/l339q3oldm0cd2lph4b6f93fd07x9g6s"
}
],
"release_date": "2026-09-29T11:33:51.375000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.ws.xmlschema/xmlschema-core: Apache XMLSchema: Denial of Service via unbounded recursion during schema parsing"
},
{
"cve": "CVE-2026-102496",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-29T11:51:09.212243+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543086"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache XMLSchema. When constructing its schema model, the parser does not restrict how deeply schema structures can be nested. A remote attacker could exploit this vulnerability by providing a crafted XML schema containing deeply nested elements, triggering uncontrolled recursion and a stack overflow that crashes the application, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.ws.xmlschema/xmlschema-core: Apache XMLSchema: Denial of Service (DoS) via deeply nested schema structures",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an unauthenticated remote attacker can cause a denial of service by supplying an excessively nested schema definition, leading to JVM stack exhaustion without requiring special privileges. In typical Red Hat deployments such as JBoss EAP and Red Hat build of Apache Camel, applications exposing web services or endpoints that process untrusted XML schemas can be crashed or rendered unavailable. Exploitation solely affects availability, with no impact to system integrity or confidentiality.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102496"
},
{
"category": "external",
"summary": "RHBZ#2543086",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543086"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102496"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102496",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102496"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9z1vg8wmvwpfw748fb2nb55w4hgbnxol",
"url": "https://lists.apache.org/thread/9z1vg8wmvwpfw748fb2nb55w4hgbnxol"
}
],
"release_date": "2026-09-29T11:34:04.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-11T15:52:13+00:00",
"details": "Before applying the update, make sure all previously released errata relevant to\nyour system have been applied. Also, back up your existing installation,\nincluding all applications, configuration files, databases and database\nsettings. For details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99017"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat JBoss Enterprise Application Platform 8.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.ws.xmlschema/xmlschema-core: Apache XMLSchema: Denial of Service (DoS) via deeply nested schema structures"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.