Jboss Enterprise Web Server (Redhat) - vulnerabilities (CVEs)

52 CVEs, 0 in the last 30 days, 20 known versions, newest CVE from 2026-08-19. Vendor: Redhat.

CVEs of Jboss Enterprise Web Server

CVE-2026-76166 - CVSS 4.3 (medium), 2026-08-19: A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status…
CVE-2026-50627 - CVSS 9.1 (critical), 2026-06-12: The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one…
CVE-2026-49875 - CVSS 9.8 (critical), 2026-06-12: Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations,…
CVE-2026-50628 - CVSS 9.8 (critical), 2026-06-12: A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP…
CVE-2026-45447 - CVSS 8.8 (high), 2026-06-09: Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A…
CVE-2026-49975 - CVSS 7.5 (high), 2026-06-08: Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue…
CVE-2026-40542 - CVSS 7.3 (high), 2026-04-22: Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper…
CVE-2026-2332 - CVSS 9.1 (critical), 2026-04-14: In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined…
CVE-2026-34486 - CVSS 7.5 (high), 2026-04-09: Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This…
CVE-2026-29146 - CVSS 7.5 (high), 2026-04-09: Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through…
CVE-2026-32283 - CVSS 7.5 (high), 2026-04-08: If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled…
CVE-2025-67030 - CVSS 8.8 (high), 2026-03-25: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before…
CVE-2026-1605 - CVSS 7.5 (high), 2026-03-05: In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding:…
CVE-2026-24734 - CVSS 7.5 (high), 2026-02-17: Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the…
CVE-2022-4132 - CVSS 5.9 (medium), 2023-10-04: A flaw was found in JSS. A memory leak in JSS requires non-standard configuration but is a low-effort DoS vector if configured that way (repeatedly hitting…
CVE-2022-4245 - CVSS 4.3 (medium), 2023-09-25: A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue…
CVE-2022-4244 - CVSS 7.5 (high), 2023-09-25: A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the…
CVE-2020-25710 - CVSS 7.5 (high), 2021-05-28: A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed…
CVE-2012-5626 - CVSS 7.5 (high), 2020-01-23: EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red…
CVE-2019-19906 - CVSS 7.5 (high), 2019-12-19: cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The…
CVE-2014-3699 - CVSS 9.8 (critical), 2019-12-15: eDeploy has RCE via cPickle deserialization of untrusted data
CVE-2014-3701 - CVSS 8.1 (high), 2019-12-15: eDeploy has tmp file race condition flaws
CVE-2012-2148 - CVSS 3.3 (low), 2019-12-06: An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies
CVE-2014-3700 - CVSS 9.8 (critical), 2019-11-21: eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data
CVE-2014-3655 - CVSS 4.3 (medium), 2019-11-13: JBoss KeyCloak is vulnerable to soft token deletion via CSRF
CVE-2011-3923 - CVSS 9.8 (critical), 2019-11-01: Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVE-2019-1559 - CVSS 5.9 (medium), 2019-02-27: If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL…
CVE-2018-1336 - CVSS 7.5 (high), 2018-08-02: An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service.…
CVE-2018-1304 - CVSS 5.9 (medium), 2018-02-28: The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27,…
CVE-2015-7501 - CVSS 9.8 (critical), 2017-11-09: Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform…
CVE-2017-12613 - CVSS 7.1 (high), 2017-10-24: When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of…
CVE-2017-12617 - CVSS 8.1 (high), 2017-10-04: When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the…
CVE-2015-5184 - CVSS 7.5 (high), 2017-09-25: Console: CORS headers set to allow all in Red Hat AMQ.
CVE-2015-5183 - CVSS 7.5 (high), 2017-09-25: Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
CVE-2017-12615 - CVSS 8.1 (high), 2017-09-19: When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false)…
CVE-2016-6796 - CVSS 7.5 (high), 2017-08-11: A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able…
CVE-2016-6797 - CVSS 7.5 (high), 2017-08-10: The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not…
CVE-2016-6794 - CVSS 5.3 (medium), 2017-08-10: When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat…
CVE-2016-5018 - CVSS 9.1 (critical), 2017-08-10: In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass…
CVE-2016-0762 - CVSS 5.9 (medium), 2017-08-10: The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not…
CVE-2017-9788 - CVSS 9.1 (critical), 2017-07-13: In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset…
CVE-2016-8735 - CVSS 9.8 (critical), 2017-04-06: Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
CVE-2016-3110 - CVSS 7.5 (high), 2016-09-26: mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message…
CVE-2016-2183 - CVSS 7.5 (high), 2016-09-01: The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four…
CVE-2016-5387 - CVSS 8.1 (high), 2016-07-19: The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data…
CVE-2014-0224 - CVSS 7.4 (high), 2014-06-05: OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows…
CVE-2013-5704 - CVSS 5 (medium), 2014-04-15: The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer…
CVE-2013-2186 - CVSS 7.5 (high), 2013-10-28: The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web…
CVE-2013-1976 - CVSS 6.9 (medium), 2013-07-09: The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red…
CVE-2012-0053 - CVSS 4.3 (medium), 2012-01-28: protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error…
CVE-2012-0031 - CVSS 4.6 (medium), 2012-01-18: scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have…
CVE-2011-3348 - CVSS 4.3 (medium), 2011-09-20: The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to…