Jboss Fuse (Redhat) - vulnerabilities (CVEs)

258 CVEs, 3 in the last 30 days, 15 known versions, newest CVE from 2026-10-21. Vendor: Redhat.

CVEs of Jboss Fuse

CVE-2026-114370 - CVSS 3.7 (low), 2026-10-21: A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system.…
CVE-2026-84823 - CVSS 7.1 (high), 2026-10-15: A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal…
CVE-2026-85634 - CVSS 8.8 (high), 2026-10-15: A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage…
CVE-2026-94449 - CVSS 7.5 (high), 2026-09-21: A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices.…
CVE-2026-93562 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request…
CVE-2026-93574 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1…
CVE-2026-93432 - CVSS 6.1 (medium), 2026-09-18: A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content…
CVE-2026-93579 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage…
CVE-2026-93573 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the…
CVE-2026-93568 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's…
CVE-2026-93576 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP…
CVE-2026-85511 - CVSS 4.2 (medium), 2026-09-18: A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow…
CVE-2026-93569 - CVSS 8.2 (high), 2026-09-18: A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1…
CVE-2026-93567 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the…
CVE-2026-93566 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the…
CVE-2026-10832 - CVSS 5.9 (medium), 2026-09-18: A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a…
CVE-2026-93565 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time…
CVE-2026-93564 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted…
CVE-2026-93558 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to…
CVE-2026-93560 - CVSS 7.5 (high), 2026-09-18: A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum…
CVE-2026-93492 - CVSS 5.3 (medium), 2026-09-18: A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE.…
CVE-2026-93491 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single…
CVE-2026-93488 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to…
CVE-2026-93563 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit…
CVE-2026-93572 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis…
CVE-2026-93575 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet.…
CVE-2026-93561 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types…
CVE-2026-87743 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and…
CVE-2026-93494 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body…
CVE-2026-89058 - CVSS 7.4 (high), 2026-09-18: A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the…
CVE-2026-89059 - CVSS 7.5 (high), 2026-09-18: A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image…
CVE-2026-84218 - CVSS 8.1 (high), 2026-09-01: A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist…
CVE-2026-17615 - CVSS 7.5 (high), 2026-08-31: A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By…
CVE-2026-81624 - CVSS 7.5 (high), 2026-08-31: Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically,…
CVE-2026-5680 - CVSS 7.5 (high), 2026-08-27: A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate…
CVE-2026-14180 - CVSS 5.3 (medium), 2026-08-11: A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The…
CVE-2026-15567 - CVSS 7.5 (high), 2026-08-11: A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled…
CVE-2026-15565 - CVSS 7.5 (high), 2026-08-11: A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has…
CVE-2026-15563 - CVSS 7.4 (high), 2026-08-11: A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups…
CVE-2026-24330 - CVSS 6.5 (medium), 2026-08-11: A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted…
CVE-2026-24329 - CVSS 4.9 (medium), 2026-08-11: A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the…
CVE-2026-57915 - CVSS 7.3 (high), 2026-06-26: It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are…
CVE-2026-11998 - CVSS 7.6 (high), 2026-06-24: A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript…
CVE-2026-46417 - CVSS 8.8 (high), 2026-06-22: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.12,…
CVE-2026-50556 - CVSS 8.6 (high), 2026-06-22: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2,…
CVE-2026-50559 - CVSS 7.5 (high), 2026-06-19: Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2,…
CVE-2026-48779 - CVSS 7.5 (high), 2026-06-16: ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up…
CVE-2026-12143 - CVSS 8.7 (high), 2026-06-12: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the…
CVE-2026-50011 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-50010 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-48043 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and…
CVE-2026-48006 - CVSS 8.7 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the…
CVE-2026-47691 - CVSS 10 (critical), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's…
CVE-2026-48059 - CVSS 8.7 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY…
CVE-2026-45674 - CVSS 10 (critical), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's…
CVE-2026-46340 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and…
CVE-2026-45416 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-44893 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and…
CVE-2026-50633 - CVSS 8.1 (high), 2026-06-12: A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to…
CVE-2026-50632 - CVSS 8.8 (high), 2026-06-12: A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can…
CVE-2026-50627 - CVSS 9.1 (critical), 2026-06-12: The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one…
CVE-2026-49875 - CVSS 9.8 (critical), 2026-06-12: Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations,…
CVE-2026-50628 - CVSS 9.8 (critical), 2026-06-12: A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP…
CVE-2026-44250 - CVSS 7.5 (high), 2026-06-11: Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and…
CVE-2026-44249 - CVSS 8.1 (high), 2026-06-11: Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-44890 - CVSS 7.5 (high), 2026-06-11: Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and…
CVE-2026-44495 - CVSS 7.7 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in…
CVE-2026-44494 - CVSS 8.7 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution…
CVE-2026-44492 - CVSS 8.6 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When…
CVE-2026-44496 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a…
CVE-2026-44487 - CVSS 8.2 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization…
CVE-2026-44486 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a…
CVE-2026-44488 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size…
CVE-2026-41731 - CVSS 8.1 (high), 2026-06-10: JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting…
CVE-2025-71319 - CVSS 8.7 (high), 2026-06-09: image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a…
CVE-2026-40984 - CVSS 7.5 (high), 2026-06-09: In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions:…
CVE-2026-40983 - CVSS 7.5 (high), 2026-06-09: In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions:…
CVE-2026-9277 - CVSS 9.2 (critical), 2026-05-22: shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped…
CVE-2026-44417 - CVSS 7.5 (high), 2026-05-22: The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code…
CVE-2026-44930 - CVSS 9.8 (critical), 2026-05-22: An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates…
CVE-2026-47323 - CVSS 9.8 (critical), 2026-05-19: Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations…
CVE-2026-45736 - CVSS 7.5 (high), 2026-05-15: ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory…
CVE-2026-44248 - CVSS 7.5 (high), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed…
CVE-2026-42587 - CVSS 7.5 (high), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation…
CVE-2026-42584 - CVSS 9.1 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response…
CVE-2026-42578 - CVSS 7.5 (high), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP…
CVE-2026-42581 - CVSS 9.8 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting…
CVE-2026-42579 - CVSS 9.1 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035…
CVE-2026-42264 - CVSS 9.1 (critical), 2026-05-08: Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL,…
CVE-2026-41674 - CVSS 8.7 (high), 2026-05-07: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and…
CVE-2026-41673 - CVSS 8.7 (high), 2026-05-07: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and…
CVE-2026-41672 - CVSS 8.7 (high), 2026-05-07: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and…
CVE-2026-41675 - CVSS 8.7 (high), 2026-05-07: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and…
CVE-2026-39852 - CVSS 8.8 (high), 2026-05-05: Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path…
CVE-2026-43868 - CVSS 7.5 (high), 2026-05-05: Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade…
CVE-2026-43869 - CVSS 7.3 (high), 2026-05-05: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended…
CVE-2026-42440 - CVSS 7.5 (high), 2026-05-04: OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader Versions Affected: before 1.9.5 before 2.5.9 before 3.0.0-M3 …
CVE-2026-42027 - CVSS 9.8 (critical), 2026-05-04: Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3…
CVE-2026-40682 - CVSS 9.1 (critical), 2026-05-04: XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions Affected: before 2.5.9, before 3.0.0-M3…
CVE-2026-40976 - CVSS 9.1 (critical), 2026-04-28: In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be…