Jbosseapxp (Redhat) - vulnerabilities (CVEs)

260 CVEs, 3 in the last 30 days, 1 known versions, newest CVE from 2026-10-21. Vendor: Redhat.

CVEs of Jbosseapxp

CVE-2026-114370 - CVSS 3.7 (low), 2026-10-21: A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system.…
CVE-2026-84823 - CVSS 7.1 (high), 2026-10-15: A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal…
CVE-2026-85634 - CVSS 8.8 (high), 2026-10-15: A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage…
CVE-2026-93579 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage…
CVE-2026-93568 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's…
CVE-2026-85511 - CVSS 4.2 (medium), 2026-09-18: A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow…
CVE-2026-93569 - CVSS 8.2 (high), 2026-09-18: A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1…
CVE-2026-93567 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the…
CVE-2026-10832 - CVSS 5.9 (medium), 2026-09-18: A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a…
CVE-2026-93492 - CVSS 5.3 (medium), 2026-09-18: A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE.…
CVE-2026-89058 - CVSS 7.4 (high), 2026-09-18: A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the…
CVE-2026-89059 - CVSS 7.5 (high), 2026-09-18: A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image…
CVE-2026-81829 - CVSS 5.3 (medium), 2026-09-17: A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When…
CVE-2026-17526 - CVSS 7.2 (high), 2026-09-16: Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a…
CVE-2026-18212 - CVSS 7.5 (high), 2026-09-16: A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the…
CVE-2026-17615 - CVSS 7.5 (high), 2026-08-31: A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By…
CVE-2026-12894 - CVSS 8.8 (high), 2026-08-31: A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the…
CVE-2026-81624 - CVSS 7.5 (high), 2026-08-31: Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically,…
CVE-2026-5680 - CVSS 7.5 (high), 2026-08-27: A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate…
CVE-2026-19611 - CVSS 7.4 (high), 2026-08-20: A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII…
CVE-2026-76166 - CVSS 4.3 (medium), 2026-08-19: A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status…
CVE-2026-15571 - CVSS 7.3 (high), 2026-08-18: A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The…
CVE-2026-18963 - CVSS 9.1 (critical), 2026-08-18: A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat…
CVE-2026-19879 - CVSS 5.3 (medium), 2026-08-14: A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from…
CVE-2026-14180 - CVSS 5.3 (medium), 2026-08-11: A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The…
CVE-2026-15567 - CVSS 7.5 (high), 2026-08-11: A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled…
CVE-2026-15565 - CVSS 7.5 (high), 2026-08-11: A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has…
CVE-2026-15563 - CVSS 7.4 (high), 2026-08-11: A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups…
CVE-2026-15562 - CVSS 7.5 (high), 2026-08-11: A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting…
CVE-2026-15561 - CVSS 7.5 (high), 2026-08-11: A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated…
CVE-2026-15560 - CVSS 8.1 (high), 2026-08-11: when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an…
CVE-2026-15556 - CVSS 8.1 (high), 2026-08-11: A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an…
CVE-2026-15554 - CVSS 7.4 (high), 2026-08-11: the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an…
CVE-2026-15555 - CVSS 8.8 (high), 2026-08-11: A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River…
CVE-2026-24330 - CVSS 6.5 (medium), 2026-08-11: A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted…
CVE-2026-24329 - CVSS 4.9 (medium), 2026-08-11: A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the…
CVE-2026-18967 - CVSS 8.1 (high), 2026-08-06: A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the…
CVE-2026-16442 - CVSS 9.8 (critical), 2026-08-05: A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the…
CVE-2026-16100 - CVSS 6.5 (medium), 2026-08-05: A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account…
CVE-2026-16071 - CVSS 5.4 (medium), 2026-08-05: A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a…
CVE-2026-16102 - CVSS 8.1 (high), 2026-08-05: A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to…
CVE-2026-15573 - CVSS 8.1 (high), 2026-08-05: A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not…
CVE-2026-16443 - CVSS 9.1 (critical), 2026-08-05: A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat…
CVE-2026-18569 - CVSS 3.7 (low), 2026-08-04: A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles…
CVE-2026-17614 - CVSS 4.4 (medium), 2026-08-04: A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in…
CVE-2026-18573 - CVSS 6.5 (medium), 2026-08-02: A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a…
CVE-2026-18572 - CVSS 6.5 (medium), 2026-08-02: Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access…
CVE-2026-18571 - CVSS 7.2 (high), 2026-08-02: A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator…
CVE-2026-18570 - CVSS 5.4 (medium), 2026-08-02: A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing…
CVE-2026-18209 - CVSS 4.7 (medium), 2026-07-31: A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the…
CVE-2026-18206 - CVSS 3.7 (low), 2026-07-31: A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm…
CVE-2026-18203 - CVSS 6.5 (medium), 2026-07-31: A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend…
CVE-2026-18214 - CVSS 8.1 (high), 2026-07-31: Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where…
CVE-2026-18211 - CVSS 5.4 (medium), 2026-07-31: A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security…
CVE-2026-18208 - CVSS 6.5 (medium), 2026-07-31: A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management…
CVE-2026-16105 - CVSS 4.9 (medium), 2026-07-31: A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not…
CVE-2026-18215 - CVSS 8.1 (high), 2026-07-31: Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where…
CVE-2026-18217 - CVSS 4.7 (medium), 2026-07-31: A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak…
CVE-2026-18218 - CVSS 5.4 (medium), 2026-07-31: A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific…
CVE-2026-18201 - CVSS 5.5 (medium), 2026-07-29: Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with…
CVE-2026-18207 - CVSS 6.5 (medium), 2026-07-29: A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique…
CVE-2026-17059 - CVSS 6.5 (medium), 2026-07-24: A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management…
CVE-2026-17048 - CVSS 5.5 (medium), 2026-07-24: A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for…
CVE-2026-16104 - CVSS 6.5 (medium), 2026-07-17: A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak…
CVE-2026-16103 - CVSS 4.3 (medium), 2026-07-17: A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were…
CVE-2026-16106 - CVSS 4.9 (medium), 2026-07-17: A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to…
CVE-2026-16108 - CVSS 6.5 (medium), 2026-07-17: A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are…
CVE-2026-16093 - CVSS 5.4 (medium), 2026-07-17: Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for…
CVE-2026-16089 - CVSS 5.9 (medium), 2026-07-17: A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly…
CVE-2026-16072 - CVSS 4.9 (medium), 2026-07-17: A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an…
CVE-2026-15943 - CVSS 5.5 (medium), 2026-07-17: A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated…
CVE-2026-15945 - CVSS 4.3 (medium), 2026-07-16: A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a…
CVE-2026-1609 - CVSS 8.1 (high), 2026-07-16: A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to…
CVE-2025-12799 - CVSS 6.5 (medium), 2026-07-07: A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters…
CVE-2026-14781 - CVSS 4.8 (medium), 2026-07-05: A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider…
CVE-2026-14614 - CVSS 5.4 (medium), 2026-07-03: A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a…
CVE-2026-14613 - CVSS 4.9 (medium), 2026-07-03: A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have…
CVE-2026-14209 - CVSS 4.3 (medium), 2026-06-30: A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained…
CVE-2026-57915 - CVSS 7.3 (high), 2026-06-26: It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are…
CVE-2026-11800 - CVSS 8.1 (high), 2026-06-25: A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials…
CVE-2026-9800 - CVSS 8.1 (high), 2026-06-25: A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope,…
CVE-2026-11998 - CVSS 7.6 (high), 2026-06-24: A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript…
CVE-2026-54513 - CVSS 8.1 (high), 2026-06-23: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and…
CVE-2026-50559 - CVSS 7.5 (high), 2026-06-19: Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2,…
CVE-2026-48779 - CVSS 7.5 (high), 2026-06-16: ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up…
CVE-2026-12143 - CVSS 8.7 (high), 2026-06-12: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the…
CVE-2026-50011 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-50010 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-47691 - CVSS 10 (critical), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's…
CVE-2026-48059 - CVSS 8.7 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY…
CVE-2026-48043 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and…
CVE-2026-48006 - CVSS 8.7 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the…
CVE-2026-46340 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and…
CVE-2026-45674 - CVSS 10 (critical), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's…
CVE-2026-45416 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-44893 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and…
CVE-2026-50632 - CVSS 8.8 (high), 2026-06-12: A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can…
CVE-2026-50633 - CVSS 8.1 (high), 2026-06-12: A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to…
CVE-2026-50628 - CVSS 9.8 (critical), 2026-06-12: A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP…
CVE-2026-50627 - CVSS 9.1 (critical), 2026-06-12: The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one…