{"schema_version":"1","data":[{"id":29871,"advisory_id":"fb242ebc-6734-4010-b9cf-6ab7771815f1","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93574","source_published_at":"2026-09-18T20:12:43.146+00:00","published_at":"2026-10-25T08:06:22.035415+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93574"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing","summary":"A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.","evidence":"cve:CVE-2026-93574","products":[{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93574","aliases":["CVE-2026-93574"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"}],"modified":"2026-10-15T17:01:26.141Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93574","https://bugzilla.redhat.com/show_bug.cgi?id=2536966"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93574","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-21T18:18:47.806786Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-21T18:19:07.477Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T17:01:26.141Z"}}},"related_cves":[{"value":"CVE-2026-93574","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29870,"advisory_id":"5bd1d8bb-4751-4354-9018-b00b2c99cd45","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93562","source_published_at":"2026-09-18T20:12:51.91+00:00","published_at":"2026-10-25T08:06:21.44339+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93562"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling","summary":"A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.","evidence":"cve:CVE-2026-93562","products":[{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93562","aliases":["CVE-2026-93562"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"}],"modified":"2026-10-15T17:01:19.905Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93562","https://bugzilla.redhat.com/show_bug.cgi?id=2536951"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93562","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-22T16:17:26.080353Z"}}}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536951","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-22T16:17:31.584Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T17:01:19.905Z"}}},"related_cves":[{"value":"CVE-2026-93562","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29868,"advisory_id":"0d1e23b1-aeb6-4909-b405-7a7d27adbd54","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93566","source_published_at":"2026-09-18T14:19:29.741+00:00","published_at":"2026-10-25T08:06:20.852904+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93566"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line","summary":"A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.","evidence":"cve:CVE-2026-93566","products":[{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93566","aliases":["CVE-2026-93566"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"}],"modified":"2026-10-15T17:01:19.077Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93566","https://bugzilla.redhat.com/show_bug.cgi?id=2536954"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93566","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-22T14:28:28.241291Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-22T14:28:43.220Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T17:01:19.077Z"}}},"related_cves":[{"value":"CVE-2026-93566","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29867,"advisory_id":"b9bb6ece-ea77-4b82-8210-e0e85272e964","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93573","source_published_at":"2026-09-18T14:44:00.077+00:00","published_at":"2026-10-25T08:06:20.250488+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93573"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling","summary":"A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.","evidence":"cve:CVE-2026-93573","products":[{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93573","aliases":["CVE-2026-93573"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"}],"modified":"2026-10-15T17:01:20.443Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93573","https://bugzilla.redhat.com/show_bug.cgi?id=2536964"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93573","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-18T16:19:54.114434Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T16:20:09.086Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T17:01:20.443Z"}}},"related_cves":[{"value":"CVE-2026-93573","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29865,"advisory_id":"a80d4f75-6e12-4826-a186-4d4fd1f85d69","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19611","source_published_at":"2026-08-20T15:58:24.19+00:00","published_at":"2026-10-25T08:06:18.853164+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-build-of-apache-camel-3-33-3-sp2","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-debezium-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-jboss-enterprise-application-platform-expansion-pack","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-19611"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding","summary":"A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.","evidence":"cve:CVE-2026-19611","products":[{"name":{"value":"Red Hat Build of Apache Camel 3.33.3.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Debezium 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-19611","aliases":["CVE-2026-19611"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"],"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 3.33.3.SP2","versions":[{"status":"unaffected","version":"2.8.4.Final-redhat-00002","lessThan":"*","versionType":"rpm"}],"packageName":"org.wildfly.security/wildfly-elytron-password-impl","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"wildfly-elytron-password-impl","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"wildfly-elytron-password-impl","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"wildfly-elytron-password-impl","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:debezium:3"],"vendor":"Red Hat","product":"Red Hat build of Debezium 3","packageName":"wildfly-elytron-password-impl","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"keycloak/rhbk-openshift-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"wildfly-elytron-password-impl","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"wildfly-elytron-password-impl","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"jboss-eap-7/eap74-els-openjdk17-openshift-rhel8","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"jboss-eap-7/eap74-els-openjdk8-openshift-rhel8","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"wildfly-elytron-password-impl","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"wildfly-elytron-password-impl","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"wildfly-elytron-password-impl","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"wildfly-elytron-password-impl","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T17:01:05.567Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:70257","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-19611","https://bugzilla.redhat.com/show_bug.cgi?id=2514568"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19611","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-08-21T16:38:31.494304Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-21T16:39:12.830Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T17:01:05.567Z"}}},"related_cves":[{"value":"CVE-2026-19611","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29851,"advisory_id":"ba32010f-7f17-4a89-8e6c-d27f1ed65207","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93565","source_published_at":"2026-09-18T14:18:11.431+00:00","published_at":"2026-10-25T08:06:10.077679+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-3-33-3-sp2","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93565"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte","summary":"A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.","evidence":"cve:CVE-2026-93565","products":[{"name":{"value":"Red Hat Build of Apache Camel 3.33.3.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93565","aliases":["CVE-2026-93565"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"],"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 3.33.3.SP2","versions":[{"status":"unaffected","version":"4.1.138.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.netty/netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T16:42:40.628Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:70257","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93565","https://bugzilla.redhat.com/show_bug.cgi?id=2536952"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93565","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-21T19:48:34.585168Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-21T20:51:46.984Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T16:42:40.628Z"}}},"related_cves":[{"value":"CVE-2026-93565","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29849,"advisory_id":"b83c1009-7f66-484f-954e-76d34f70bdc1","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93558","source_published_at":"2026-09-18T14:09:01.96+00:00","published_at":"2026-10-25T08:06:08.820912+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-3-33-3-sp2","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93558"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service","summary":"A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.","evidence":"cve:CVE-2026-93558","products":[{"name":{"value":"Red Hat Build of Apache Camel 3.33.3.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93558","aliases":["CVE-2026-93558"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"],"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 3.33.3.SP2","versions":[{"status":"unaffected","version":"4.1.138.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.netty/netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T16:42:33.129Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:70257","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93558","https://bugzilla.redhat.com/show_bug.cgi?id=2536932"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93558","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-18T14:54:07.542588Z"}}}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536932","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T14:54:19.353Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T16:42:33.129Z"}}},"related_cves":[{"value":"CVE-2026-93558","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29848,"advisory_id":"49f02c88-9eef-44f0-af01-8ebffec22ec7","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93491","source_published_at":"2026-09-18T12:43:26.091+00:00","published_at":"2026-10-25T08:06:08.223859+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-3-33-3-sp2","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93491"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue","summary":"A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.","evidence":"cve:CVE-2026-93491","products":[{"name":{"value":"Red Hat Build of Apache Camel 3.33.3.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93491","aliases":["CVE-2026-93491"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"],"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 3.33.3.SP2","versions":[{"status":"unaffected","version":"4.1.138.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.netty/netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T16:42:28.138Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:70257","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93491","https://bugzilla.redhat.com/show_bug.cgi?id=2536891","https://github.com/netty/netty/releases/tag/netty-4.1.138.Final","https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93491","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-18T19:06:39.794513Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T19:06:57.127Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T16:42:28.138Z"}}},"related_cves":[{"value":"CVE-2026-93491","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29847,"advisory_id":"411cdbd8-3d81-483b-ad0f-81394ea2305d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93488","source_published_at":"2026-09-18T11:47:52.574+00:00","published_at":"2026-10-25T08:06:07.637889+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-3-33-3-sp2","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93488"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams","summary":"A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.","evidence":"cve:CVE-2026-93488","products":[{"name":{"value":"Red Hat Build of Apache Camel 3.33.3.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93488","aliases":["CVE-2026-93488"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"],"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 3.33.3.SP2","versions":[{"status":"unaffected","version":"4.1.138.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.netty/netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T16:42:26.266Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:70257","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93488","https://bugzilla.redhat.com/show_bug.cgi?id=2536887","https://github.com/netty/netty/releases/tag/netty-4.1.138.Final","https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93488","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-18T14:56:31.822535Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T14:56:42.825Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T16:42:26.266Z"}}},"related_cves":[{"value":"CVE-2026-93488","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":22827,"advisory_id":"02beae68-5eee-4a5d-b950-b9469093ddb9","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-3884","source_published_at":"2025-12-03T18:40:25.606+00:00","published_at":"2026-10-25T06:07:59.457889+00:00","extraction_method":"structured","technologies":["core-cve","openshift-serverless","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apache-camel-hawtio-4","red-hat-build-of-apicurio-registry-2","red-hat-build-of-keycloak","red-hat-build-of-optaplanner-8","red-hat-build-of-quarkus","red-hat-data-grid-8","red-hat-fuse-7","red-hat-integration-camel-k-1","red-hat-integration-camel-quarkus-2","red-hat-jboss-data-grid-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-7-1-eus-for-rhel-7","red-hat-jboss-enterprise-application-platform-7-3-eus-for-rhel-7","red-hat-jboss-enterprise-application-platform-7-4-24","red-hat-jboss-enterprise-application-platform-7-4-els-on-rhel-7","red-hat-jboss-enterprise-application-platform-7-4-els-on-rhel-8","red-hat-jboss-enterprise-application-platform-7-4-els-on-rhel-9","red-hat-jboss-enterprise-application-platform-8-0","red-hat-jboss-enterprise-application-platform-8-0-for-rhel-8","red-hat-jboss-enterprise-application-platform-8-0-for-rhel-9","red-hat-jboss-enterprise-application-platform-8-1-3","red-hat-jboss-enterprise-application-platform-8-1-for-rhel-8","red-hat-jboss-enterprise-application-platform-8-1-for-rhel-9","red-hat-jboss-enterprise-application-platform-expansion-pack","red-hat-jboss-fuse-service-works-6","red-hat-process-automation-7","red-hat-single-sign-on-7","streams-for-apache-kafka"],"cve_ids":["CVE-2024-3884"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded","summary":"A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack.","evidence":"cve:CVE-2024-3884","products":[{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4.24","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1.3","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/25/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/26/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/27/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/28/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/29/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/30/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/31/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/32/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/33/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/34/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/35/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/36/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/37/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/38/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/39/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/40/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/41/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/42/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/43/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/44/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/45/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/46/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/47/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/48/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/49/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/50/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 3","evidence":"/containers/cna/affected/51/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/52/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel - HawtIO 4","evidence":"/containers/cna/affected/53/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 2","evidence":"/containers/cna/affected/54/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/55/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of OptaPlanner 8","evidence":"/containers/cna/affected/56/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus","evidence":"/containers/cna/affected/57/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus","evidence":"/containers/cna/affected/58/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/59/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/60/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Integration Camel K 1","evidence":"/containers/cna/affected/61/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Integration Camel Quarkus 2","evidence":"/containers/cna/affected/62/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Data Grid 7","evidence":"/containers/cna/affected/63/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/64/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/65/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Fuse Service Works 6","evidence":"/containers/cna/affected/66/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Process Automation 7","evidence":"/containers/cna/affected/67/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/68/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"streams for Apache Kafka","evidence":"/containers/cna/affected/69/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2024-3884","aliases":["CVE-2024-3884"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}}],"affected":[{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:1.4.18-19.SP17_redhat_00001.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.1.14-4.GA_redhat_00003.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.0.41-7.SP8_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.3.17-5.GA_redhat_00006.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4.24","versions":[{"status":"unaffected","version":"2.2.39.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.undertow/undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","versions":[{"status":"unaffected","version":"0:2.2.39-1.Final_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","versions":[{"status":"unaffected","version":"0:2.2.39-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","versions":[{"status":"unaffected","version":"0:2.2.39-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:1.83.0-1.redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-bouncycastle","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:33.0.0-2.jre_redhat_00003.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-guava-libraries","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:4.0.6-1.redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jaxb","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:1.0.0-3.redhat_00009.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jcip-annotations","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.0.2-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-slf4j-jboss-logmanager","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.3.23-1.SP3_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:1.83.0-1.redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-bouncycastle","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:33.0.0-2.jre_redhat_00003.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-guava-libraries","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:4.0.6-1.redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jaxb","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:1.0.0-3.redhat_00009.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jcip-annotations","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.0.2-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-slf4j-jboss-logmanager","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.3.23-1.SP3_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1.3","versions":[{"status":"unaffected","version":"2.3.20.SP4-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.undertow/undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:4.0.10-1.redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-apache-cxf","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:1.82.0-1.redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-bouncycastle","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:801.3.0-1.GA_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eap-product-conf-parent","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:1.0.1-3.redhat_00003.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eventstream","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:6.6.36-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:4.0.2-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jboss-el-api_5.0_spec","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.5.0-1.redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jboss-threads","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.3.20-2.SP4_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:8.1.3-4.GA_redhat_00006.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:5.0.12-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly-clustering","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.6.6-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly-elytron","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:8.1.1-4.GA_redhat_00007.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly-javadocs","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:4.0.10-1.redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-apache-cxf","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:1.82.0-1.redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-bouncycastle","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:801.3.0-1.GA_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eap-product-conf-parent","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:1.0.1-3.redhat_00003.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eventstream","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:6.6.36-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:4.0.2-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jboss-el-api_5.0_spec","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.5.0-1.redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jboss-threads","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.3.20-2.SP4_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:8.1.3-4.GA_redhat_00006.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:5.0.12-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly-clustering","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.6.6-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly-elytron","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:8.1.1-4.GA_redhat_00007.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly-javadocs","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:camel_spring_boot:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 3","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:apache_camel_hawtio:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel - HawtIO 4","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:service_registry:2"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 2","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:optaplanner:::el6"],"vendor":"Red Hat","product":"Red Hat build of OptaPlanner 8","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:quarkus:2"],"vendor":"Red Hat","product":"Red Hat build of Quarkus","packageName":"quarkus-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Quarkus","packageName":"quarkus-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:integration:1"],"vendor":"Red Hat","product":"Red Hat Integration Camel K 1","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:camel_quarkus:2"],"vendor":"Red Hat","product":"Red Hat Integration Camel Quarkus 2","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_data_grid:7"],"vendor":"Red Hat","product":"Red Hat JBoss Data Grid 7","packageName":"undertow","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"undertow","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"undertow","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_fuse_service_works:6"],"vendor":"Red Hat","product":"Red Hat JBoss Fuse Service Works 6","packageName":"undertow","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:amq_streams:1"],"vendor":"Red Hat","product":"streams for Apache Kafka","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"}],"modified":"2026-10-14T17:27:47.203Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:0383","https://access.redhat.com/errata/RHSA-2026:0384","https://access.redhat.com/errata/RHSA-2026:0386","https://access.redhat.com/errata/RHSA-2026:3889","https://access.redhat.com/errata/RHSA-2026:3891","https://access.redhat.com/errata/RHSA-2026:3892","https://access.redhat.com/errata/RHSA-2026:4915","https://access.redhat.com/errata/RHSA-2026:4916","https://access.redhat.com/errata/RHSA-2026:4917","https://access.redhat.com/errata/RHSA-2026:4924","https://access.redhat.com/errata/RHSA-2026:6011","https://access.redhat.com/errata/RHSA-2026:6012","https://access.redhat.com/security/cve/CVE-2024-3884","https://bugzilla.redhat.com/show_bug.cgi?id=2275287"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-3884","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-12-03T20:50:16.644717Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-05T16:41:59.098Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-14T17:27:47.203Z"}}},"related_cves":[{"value":"CVE-2024-3884","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":22273,"advisory_id":"3e800d30-d0e9-46ad-826b-e9d300bab0ab","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-28369","source_published_at":"2026-03-27T16:13:05.719+00:00","published_at":"2026-10-25T05:59:27.492613+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apache-camel-hawtio-4","red-hat-data-grid-8","red-hat-enterprise-linux-10","red-hat-enterprise-linux-8","red-hat-enterprise-linux-9","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-jboss-enterprise-application-platform-8-1-6","red-hat-jboss-enterprise-application-platform-8-1-for-rhel-8","red-hat-jboss-enterprise-application-platform-8-1-for-rhel-9","red-hat-jboss-enterprise-application-platform-expansion-pack","red-hat-process-automation-7","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-28369"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Undertow: undertow: request smuggling via malformed http request headers","summary":"A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.","evidence":"cve:CVE-2026-28369","products":[{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1.6","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel - HawtIO 4","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 8","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 8","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Process Automation 7","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-28369","aliases":["CVE-2026-28369"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1.6","versions":[{"status":"unaffected","version":"2.3.24.SP2-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.undertow/undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.40.0-7.redhat_00015.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-activemq-artemis","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:801.6.1-1.GA_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eap-product-conf-parent","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.3.24-3.SP2_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:8.1.6-7.GA_redhat_00010.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.40.0-7.redhat_00015.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-activemq-artemis","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:801.6.1-1.GA_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eap-product-conf-parent","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.3.24-3.SP2_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:8.1.6-7.GA_redhat_00010.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apache_camel_hawtio:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel - HawtIO 4","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"moditect","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/o:redhat:enterprise_linux:8"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-core:10.6/resteasy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/o:redhat:enterprise_linux:8"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-deps:10.6/resteasy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"resteasy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"org.jberet-jberet-parent","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"org.jberet-jberet-parent","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"org.jboss.eap-jboss-eap-xp","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-14T16:32:08.800Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:25125","https://access.redhat.com/errata/RHSA-2026:25126","https://access.redhat.com/security/cve/CVE-2026-28369","https://bugzilla.redhat.com/show_bug.cgi?id=2443262"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-28369","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-03-28T03:55:51.631071Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-03-29T13:56:11.063Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-14T16:32:08.800Z"}}},"related_cves":[{"value":"CVE-2026-28369","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":22272,"advisory_id":"3259afae-602d-4a5b-9b20-ead619578d0d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-28368","source_published_at":"2026-03-27T16:13:03.775+00:00","published_at":"2026-10-25T05:59:26.917702+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apache-camel-hawtio-4","red-hat-data-grid-8","red-hat-enterprise-linux-10","red-hat-enterprise-linux-8","red-hat-enterprise-linux-9","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-jboss-enterprise-application-platform-8-1-6","red-hat-jboss-enterprise-application-platform-8-1-for-rhel-8","red-hat-jboss-enterprise-application-platform-8-1-for-rhel-9","red-hat-jboss-enterprise-application-platform-expansion-pack","red-hat-process-automation-7","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-28368"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Undertow: undertow: request smuggling via inconsistent header parsing","summary":"A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.","evidence":"cve:CVE-2026-28368","products":[{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1.6","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel - HawtIO 4","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 8","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 8","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Process Automation 7","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-28368","aliases":["CVE-2026-28368"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1.6","versions":[{"status":"unaffected","version":"2.3.24.SP2-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.undertow/undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.40.0-7.redhat_00015.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-activemq-artemis","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:801.6.1-1.GA_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eap-product-conf-parent","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.3.24-3.SP2_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:8.1.6-7.GA_redhat_00010.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.40.0-7.redhat_00015.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-activemq-artemis","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:801.6.1-1.GA_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eap-product-conf-parent","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.3.24-3.SP2_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:8.1.6-7.GA_redhat_00010.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apache_camel_hawtio:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel - HawtIO 4","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"moditect","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/o:redhat:enterprise_linux:8"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-core:10.6/resteasy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/o:redhat:enterprise_linux:8"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-deps:10.6/resteasy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"resteasy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"org.jberet-jberet-parent","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"org.jberet-jberet-parent","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"org.jboss.eap-jboss-eap-xp","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-14T16:31:57.233Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:25125","https://access.redhat.com/errata/RHSA-2026:25126","https://access.redhat.com/security/cve/CVE-2026-28368","https://bugzilla.redhat.com/show_bug.cgi?id=2443261"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-28368","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-03-27T18:49:45.702271Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-03-27T19:57:36.565Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-14T16:31:57.233Z"}}},"related_cves":[{"value":"CVE-2026-28368","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":22271,"advisory_id":"8acb250a-77f7-4c00-ab22-8f4fdda6dff3","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-28367","source_published_at":"2026-03-27T16:13:05.108+00:00","published_at":"2026-10-25T05:59:26.160885+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apache-camel-hawtio-4","red-hat-data-grid-8","red-hat-enterprise-linux-10","red-hat-enterprise-linux-8","red-hat-enterprise-linux-9","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-jboss-enterprise-application-platform-8-1-6","red-hat-jboss-enterprise-application-platform-8-1-for-rhel-8","red-hat-jboss-enterprise-application-platform-8-1-for-rhel-9","red-hat-jboss-enterprise-application-platform-expansion-pack","red-hat-process-automation-7","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-28367"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Undertow: undertow: request smuggling via `\\r\\r\\r` as a header block terminator","summary":"A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\\r\\r\\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.","evidence":"cve:CVE-2026-28367","products":[{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1.6","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel - HawtIO 4","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 8","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 8","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Process Automation 7","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-28367","aliases":["CVE-2026-28367"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1.6","versions":[{"status":"unaffected","version":"2.3.24.SP2-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.undertow/undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.40.0-7.redhat_00015.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-activemq-artemis","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:801.6.1-1.GA_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eap-product-conf-parent","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.3.24-3.SP2_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:8.1.6-7.GA_redhat_00010.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.40.0-7.redhat_00015.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-activemq-artemis","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:801.6.1-1.GA_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eap-product-conf-parent","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.3.24-3.SP2_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:8.1.6-7.GA_redhat_00010.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apache_camel_hawtio:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel - HawtIO 4","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"moditect","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/o:redhat:enterprise_linux:8"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-core:10.6/resteasy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/o:redhat:enterprise_linux:8"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-deps:10.6/resteasy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"resteasy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"org.jberet-jberet-parent","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"org.jberet-jberet-parent","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"org.jboss.eap-jboss-eap-xp","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-14T16:31:32.664Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:25125","https://access.redhat.com/errata/RHSA-2026:25126","https://access.redhat.com/security/cve/CVE-2026-28367","https://bugzilla.redhat.com/show_bug.cgi?id=2443260"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-28367","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-03-31T13:27:40.351547Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-03-31T13:27:54.878Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-14T16:31:32.664Z"}}},"related_cves":[{"value":"CVE-2026-28367","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":22267,"advisory_id":"e40ab896-264f-4952-b695-09be5be81275","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-9784","source_published_at":"2025-09-02T13:37:59.772+00:00","published_at":"2026-10-25T05:59:23.811737+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-build-of-apache-camel-4-14-2-for-spring-boot-3-5-8","red-hat-build-of-apache-camel-hawtio-4","red-hat-data-grid-8","red-hat-enterprise-linux-10","red-hat-enterprise-linux-8","red-hat-enterprise-linux-9","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-7-1-eus-for-rhel-7","red-hat-jboss-enterprise-application-platform-7-3-eus-for-rhel-7","red-hat-jboss-enterprise-application-platform-7-4-24","red-hat-jboss-enterprise-application-platform-7-4-els-on-rhel-7","red-hat-jboss-enterprise-application-platform-7-4-els-on-rhel-8","red-hat-jboss-enterprise-application-platform-7-4-els-on-rhel-9","red-hat-jboss-enterprise-application-platform-8","red-hat-jboss-enterprise-application-platform-8-0","red-hat-jboss-enterprise-application-platform-8-0-for-rhel-8","red-hat-jboss-enterprise-application-platform-8-0-for-rhel-9","red-hat-jboss-enterprise-application-platform-8-1-3","red-hat-jboss-enterprise-application-platform-8-1-for-rhel-8","red-hat-jboss-enterprise-application-platform-8-1-for-rhel-9","red-hat-jboss-enterprise-application-platform-expansion-pack","red-hat-process-automation-7","red-hat-single-sign-on-7-6-13","red-hat-single-sign-on-7-6-for-rhel-7","red-hat-single-sign-on-7-6-for-rhel-8","red-hat-single-sign-on-7-6-for-rhel-9","rhel-8-based-middleware-containers"],"cve_ids":["CVE-2025-9784"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Undertow: undertow madeyoureset http/2 ddos vulnerability","summary":"A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).","evidence":"cve:CVE-2025-9784","products":[{"name":{"value":"Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4.24","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1.3","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/25/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/26/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/27/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/28/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/29/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/30/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/31/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/32/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/33/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/34/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/35/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","evidence":"/containers/cna/affected/36/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/37/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/38/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/39/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/40/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/41/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/42/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/43/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/44/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/45/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/46/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/47/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","evidence":"/containers/cna/affected/48/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6.13","evidence":"/containers/cna/affected/49/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6 for RHEL 7","evidence":"/containers/cna/affected/50/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6 for RHEL 8","evidence":"/containers/cna/affected/51/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6 for RHEL 9","evidence":"/containers/cna/affected/52/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"RHEL-8 based Middleware Containers","evidence":"/containers/cna/affected/53/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel - HawtIO 4","evidence":"/containers/cna/affected/54/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/55/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 10","evidence":"/containers/cna/affected/56/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 8","evidence":"/containers/cna/affected/57/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 8","evidence":"/containers/cna/affected/58/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Enterprise Linux 9","evidence":"/containers/cna/affected/59/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/60/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/61/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/62/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/63/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/64/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/65/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Process Automation 7","evidence":"/containers/cna/affected/66/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2025-9784","aliases":["CVE-2025-9784"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"versions":[{"status":"affected","version":"0","lessThan":"2.2.38.Final","versionType":"semver"}],"packageName":"undertow","collectionURL":"https://github.com/undertow-io/undertow/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:apache_camel_spring_boot:4.14"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:1.4.18-21.SP19_redhat_00001.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.0.41-8.SP9_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4.24","versions":[{"status":"unaffected","version":"2.2.39.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.undertow/undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","versions":[{"status":"unaffected","version":"0:2.2.39-1.Final_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","versions":[{"status":"unaffected","version":"0:2.2.39-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","versions":[{"status":"unaffected","version":"0:2.2.39-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:1.83.0-1.redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-bouncycastle","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:33.0.0-2.jre_redhat_00003.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-guava-libraries","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:4.0.6-1.redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jaxb","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:1.0.0-3.redhat_00009.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jcip-annotations","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.0.2-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-slf4j-jboss-logmanager","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.3.23-1.SP3_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:1.83.0-1.redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-bouncycastle","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:33.0.0-2.jre_redhat_00003.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-guava-libraries","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:4.0.6-1.redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jaxb","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:1.0.0-3.redhat_00009.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jcip-annotations","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.0.2-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-slf4j-jboss-logmanager","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.3.23-1.SP3_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1.3","versions":[{"status":"unaffected","version":"2.3.20.SP4-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.undertow/undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:4.0.10-1.redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-apache-cxf","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:1.82.0-1.redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-bouncycastle","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:801.3.0-1.GA_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eap-product-conf-parent","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:1.0.1-3.redhat_00003.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eventstream","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:6.6.36-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:4.0.2-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jboss-el-api_5.0_spec","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.5.0-1.redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jboss-threads","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.3.20-2.SP4_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:8.1.3-4.GA_redhat_00006.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:5.0.12-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly-clustering","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.6.6-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly-elytron","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","versions":[{"status":"unaffected","version":"0:8.1.1-4.GA_redhat_00007.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly-javadocs","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:4.0.10-1.redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-apache-cxf","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:1.82.0-1.redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-bouncycastle","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:801.3.0-1.GA_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eap-product-conf-parent","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:1.0.1-3.redhat_00003.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eventstream","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:6.6.36-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:4.0.2-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jboss-el-api_5.0_spec","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.5.0-1.redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jboss-threads","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.3.20-2.SP4_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:8.1.3-4.GA_redhat_00006.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:5.0.12-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly-clustering","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.6.6-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly-elytron","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","versions":[{"status":"unaffected","version":"0:8.1.1-4.GA_redhat_00007.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly-javadocs","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6.13","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6 for RHEL 7","versions":[{"status":"unaffected","version":"0:18.0.20-1.redhat_00001.1.el7sso","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso7-keycloak","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6 for RHEL 8","versions":[{"status":"unaffected","version":"0:18.0.20-1.redhat_00001.1.el8sso","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso7-keycloak","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6 for RHEL 9","versions":[{"status":"unaffected","version":"0:18.0.20-1.redhat_00001.1.el9sso","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso7-keycloak","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:rhosemc:1.0::el8"],"vendor":"Red Hat","product":"RHEL-8 based Middleware Containers","versions":[{"status":"unaffected","version":"7.6-85","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso-7/sso76-openshift-rhel8","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apache_camel_hawtio:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel - HawtIO 4","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/o:redhat:enterprise_linux:10"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"moditect","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/o:redhat:enterprise_linux:8"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-core:10.6/resteasy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/o:redhat:enterprise_linux:8"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-deps:10.6/resteasy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/o:redhat:enterprise_linux:9"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"resteasy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"org.jberet-jberet-parent","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"org.jboss.eap-jboss-eap-xp","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"org.jboss.eap-jboss-eap-xp","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-14T16:27:52.637Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2025:23143","https://access.redhat.com/errata/RHSA-2026:0383","https://access.redhat.com/errata/RHSA-2026:0384","https://access.redhat.com/errata/RHSA-2026:0386","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:33372","https://access.redhat.com/errata/RHSA-2026:3889","https://access.redhat.com/errata/RHSA-2026:3891","https://access.redhat.com/errata/RHSA-2026:3892","https://access.redhat.com/errata/RHSA-2026:4915","https://access.redhat.com/errata/RHSA-2026:4916","https://access.redhat.com/errata/RHSA-2026:4917","https://access.redhat.com/errata/RHSA-2026:4924","https://access.redhat.com/errata/RHSA-2026:76128","https://access.redhat.com/errata/RHSA-2026:76129","https://access.redhat.com/errata/RHSA-2026:76130","https://access.redhat.com/errata/RHSA-2026:76132","https://access.redhat.com/errata/RHSA-2026:76134","https://access.redhat.com/security/cve/CVE-2025-9784","https://bugzilla.redhat.com/show_bug.cgi?id=2392306","https://github.com/undertow-io/undertow/pull/1778","https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final","https://issues.redhat.com/browse/UNDERTOW-2598","https://kb.cert.org/vuls/id/767506"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-9784","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-09-02T13:55:22.694531Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-404","description":"CWE-404 Improper Resource Shutdown or Release"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-04T15:56:01.428Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.kb.cert.org/vuls/id/767506"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T20:07:57.869Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-14T16:27:52.637Z"}}},"related_cves":[{"value":"CVE-2025-9784","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12420,"advisory_id":"548c2000-3b10-4782-8bc2-8880f831e60d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-7885","source_published_at":"2024-08-21T14:13:36.579+00:00","published_at":"2026-10-25T00:07:40.154155+00:00","extraction_method":"structured","technologies":["core-cve","hawtio-4-0-0-for-red-hat-build-of-apache-camel-4","red-hat-build-of-apache-camel-3-20-7-for-spring-boot","red-hat-build-of-apache-camel-4-4-2-for-spring-boot","red-hat-build-of-apache-camel-for-spring-boot-3","red-hat-build-of-apache-camel-hawtio-4","red-hat-build-of-keycloak","red-hat-build-of-quarkus","red-hat-data-grid-8","red-hat-fuse-7","red-hat-integration-camel-k-1","red-hat-jboss-data-grid-7","red-hat-jboss-enterprise-application-platform","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-7-3-eus-for-rhel-7","red-hat-jboss-enterprise-application-platform-7-4-for-rhel-8","red-hat-jboss-enterprise-application-platform-7-4-for-rhel-9","red-hat-jboss-enterprise-application-platform-7-4-on-rhel-7","red-hat-jboss-enterprise-application-platform-8","red-hat-jboss-enterprise-application-platform-8-0-for-rhel-8","red-hat-jboss-enterprise-application-platform-8-0-for-rhel-9","red-hat-jboss-enterprise-application-platform-expansion-pack","red-hat-process-automation-7","red-hat-single-sign-on-7"],"cve_ids":["CVE-2024-7885"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Undertow: improper state management in proxy protocol parsing causes information leakage","summary":"A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.","evidence":"cve:CVE-2024-7885","products":[{"name":{"value":"HawtIO 4.0.0 for Red Hat build of Apache Camel 4","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 3.20.7 for Spring Boot","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4.4.2 for Spring Boot","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","evidence":"/containers/cna/affected/25/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","evidence":"/containers/cna/affected/26/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/27/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/28/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/29/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/30/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/31/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/32/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/33/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/34/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/35/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 3","evidence":"/containers/cna/affected/36/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel - HawtIO 4","evidence":"/containers/cna/affected/37/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/38/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus","evidence":"/containers/cna/affected/39/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/40/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/41/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Integration Camel K 1","evidence":"/containers/cna/affected/42/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Data Grid 7","evidence":"/containers/cna/affected/43/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/44/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/45/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Process Automation 7","evidence":"/containers/cna/affected/46/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/47/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2024-7885","aliases":["CVE-2024-7885"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"versions":[{"status":"affected","version":"0","lessThan":"2.2.36.Final","versionType":"custom"},{"status":"affected","version":"2.3.0.Alpha1","lessThan":"2.3.17.Final","versionType":"custom"}],"packageName":"undertow","collectionURL":"https://github.com/undertow-io/undertow","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:rhboac_hawtio:4.0"],"vendor":"Red Hat","product":"HawtIO 4.0.0 for Red Hat build of Apache Camel 4","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:apache_camel_spring_boot:3.20.7"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 3.20.7 for Spring Boot","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:apache_camel_spring_boot:4.4.2"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4.4.2 for Spring Boot","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform","versions":[{"status":"unaffected","version":"2.2.33.SP2-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.undertow/undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:1.11.0-1.redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-apache-commons-beanutils","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.4.11-1.Final_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hornetq","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:1.7.2-19.Final_redhat_00020.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jboss-server-migration","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.0.41-5.SP6_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.3.15-5.GA_redhat_00003.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.10.4-4.redhat_00008.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jackson-annotations","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.10.4-4.redhat_00008.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jackson-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.10.4-6.redhat_00008.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jackson-databind","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.10.4-4.redhat_00008.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jackson-jaxrs-providers","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.10.4-6.redhat_00008.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jackson-modules-base","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.10.4-3.redhat_00008.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jackson-modules-java8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:1.7.2-20.Final_redhat_00021.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jboss-server-migration","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:4.1.63-6.Final_redhat_00004.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-netty","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.0.41-6.SP7_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.3.16-3.GA_redhat_00003.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7","cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8","cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.2.33-2.SP2_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7","cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8","cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","versions":[{"status":"unaffected","version":"0:7.4.18-1.GA_redhat_00003.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7","cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8","cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.2.33-2.SP2_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7","cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8","cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","versions":[{"status":"unaffected","version":"0:7.4.18-1.GA_redhat_00003.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7","cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8","cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","versions":[{"status":"unaffected","version":"0:2.2.33-2.SP2_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7","cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8","cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","versions":[{"status":"unaffected","version":"0:7.4.18-1.GA_redhat_00003.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"undertow-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:1.11.9-2.redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-amazon-ion-java","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:800.3.1-2.GA_redhat_00002.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eap-product-conf-parent","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.3.14-2.SP2_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:8.0.3-13.GA_redhat_00007.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:1.11.9-2.redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-amazon-ion-java","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:800.3.1-2.GA_redhat_00002.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-eap-product-conf-parent","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.3.14-2.SP2_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8","cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:8.0.3-13.GA_redhat_00007.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 3","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apache_camel_hawtio:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel - HawtIO 4","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Quarkus","packageName":"quarkus-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:integration:1"],"vendor":"Red Hat","product":"Red Hat Integration Camel K 1","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:7"],"vendor":"Red Hat","product":"Red Hat JBoss Data Grid 7","packageName":"undertow","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-08T10:55:13.743Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2024:11023","https://access.redhat.com/errata/RHSA-2024:6508","https://access.redhat.com/errata/RHSA-2024:6883","https://access.redhat.com/errata/RHSA-2024:7441","https://access.redhat.com/errata/RHSA-2024:7442","https://access.redhat.com/errata/RHSA-2024:7735","https://access.redhat.com/errata/RHSA-2024:7736","https://access.redhat.com/errata/RHSA-2024:8080","https://access.redhat.com/errata/RHSA-2025:16667","https://access.redhat.com/errata/RHSA-2026:0743","https://access.redhat.com/security/cve/CVE-2024-7885","https://bugzilla.redhat.com/show_bug.cgi?id=2305290"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-7885","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-08-21T15:21:22.416004Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-08-21T15:21:42.735Z"}},{"title":"CVE Program Container","references":[{"url":"https://security.netapp.com/advisory/ntap-20241011-0004/"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-10-11T22:03:18.905Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-08T10:55:13.743Z"}}},"related_cves":[{"value":"CVE-2024-7885","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12337,"advisory_id":"01de1fc5-37fc-4e29-b8db-4d9147df2b6a","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-1102","source_published_at":"2024-04-25T16:24:30.245+00:00","published_at":"2026-10-25T00:05:38.458413+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-build-of-keycloak","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-data-grid-7","red-hat-jboss-enterprise-application-platform-6","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-7-4-16","red-hat-jboss-enterprise-application-platform-8","red-hat-jboss-enterprise-application-platform-8-0-for-rhel-8","red-hat-jboss-enterprise-application-platform-8-0-for-rhel-9","red-hat-jboss-enterprise-application-platform-expansion-pack","red-hat-single-sign-on-7"],"cve_ids":["CVE-2024-1102"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Jberet: jberet-core logging database credentials","summary":"A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection.","evidence":"cve:CVE-2024-1102","products":[{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4.16","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Data Grid 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 6","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 6","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 6","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 6","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 6","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 6","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 6","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 6","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2024-1102","aliases":["CVE-2024-1102"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"versions":[{"status":"affected","version":"0","lessThan":"2.2.1","versionType":"semver"}],"packageName":"jberet","collectionURL":"https://github.com/jberet/jsr352","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4.16","versions":[{"status":"unaffected","version":"1.3.9.SP3-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"org.jberet/jberet-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"jberet-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:6.2.2-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-hibernate-search","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.1.4-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jberet","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:6.2.2-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-hibernate-search","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.1.4-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap8-jberet","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"jberet-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"jberet-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"jberet-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_data_grid:7"],"vendor":"Red Hat","product":"Red Hat JBoss Data Grid 7","packageName":"jberet-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:6"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 6","packageName":"jberet-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:6"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 6","packageName":"keycloak-adapter-eap6","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:6"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 6","packageName":"keycloak-adapter-sso7_2-eap6","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:6"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 6","packageName":"keycloak-adapter-sso7_3-eap6","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:6"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 6","packageName":"keycloak-adapter-sso7_4-eap6","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:6"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 6","packageName":"keycloak-adapter-sso7_5-eap6","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:6"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 6","packageName":"org.keycloak-keycloak-parent","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:6"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 6","packageName":"rh-sso7-keycloak","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"jberet-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"jberet-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"jberet-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"}],"modified":"2026-10-07T22:44:34.654Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2024:1677","https://access.redhat.com/errata/RHSA-2024:3580","https://access.redhat.com/errata/RHSA-2024:3581","https://access.redhat.com/errata/RHSA-2024:3583","https://access.redhat.com/security/cve/CVE-2024-1102","https://bugzilla.redhat.com/show_bug.cgi?id=2262060","https://github.com/jberet/jsr352/issues/452"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-1102","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-04-25T17:44:29.138829Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-04T18:00:15.959Z"}},{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:3580","name":"RHSA-2024:3580","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3581","name":"RHSA-2024:3581","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3583","name":"RHSA-2024:3583","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1102","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262060","name":"RHBZ#2262060","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://github.com/jberet/jsr352/issues/452","tags":["x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-01T18:26:30.505Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-07T22:44:34.654Z"}}},"related_cves":[{"value":"CVE-2024-1102","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12316,"advisory_id":"bfd48ce7-9f08-4721-b2e8-39a5b458b463","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-1635","source_published_at":"2024-02-19T21:23:14.496+00:00","published_at":"2026-10-25T00:05:24.671307+00:00","extraction_method":"structured","technologies":["core-cve","openshift-serverless","red-hat-build-of-apache-camel-4-4-1-for-spring-boot-3-2","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-2","red-hat-build-of-keycloak","red-hat-build-of-optaplanner-8","red-hat-build-of-quarkus","red-hat-data-grid-8","red-hat-fuse-7-13-0","red-hat-integration-camel-k-1","red-hat-integration-camel-quarkus-2","red-hat-jboss-data-grid-7","red-hat-jboss-enterprise-application-platform-7-1-eus-for-rhel-7","red-hat-jboss-enterprise-application-platform-7-3-eus-for-rhel-7","red-hat-jboss-enterprise-application-platform-7-4-16","red-hat-jboss-enterprise-application-platform-7-4-for-rhel-8","red-hat-jboss-enterprise-application-platform-7-4-for-rhel-9","red-hat-jboss-enterprise-application-platform-7-4-on-rhel-7","red-hat-jboss-enterprise-application-platform-8","red-hat-jboss-fuse-service-works-6","red-hat-process-automation-7","red-hat-single-sign-on-7-6-for-rhel-7","red-hat-single-sign-on-7-6-for-rhel-8","red-hat-single-sign-on-7-6-for-rhel-9","rhel-8-based-middleware-containers","rhsso-7-6-8","streams-for-apache-kafka"],"cve_ids":["CVE-2024-1635"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol","summary":"A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak.","evidence":"cve:CVE-2024-1635","products":[{"name":{"value":"Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7.13.0","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4.16","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","evidence":"/containers/cna/affected/25/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6 for RHEL 7","evidence":"/containers/cna/affected/26/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6 for RHEL 8","evidence":"/containers/cna/affected/27/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6 for RHEL 9","evidence":"/containers/cna/affected/28/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"RHEL-8 based Middleware Containers","evidence":"/containers/cna/affected/29/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"RHSSO 7.6.8","evidence":"/containers/cna/affected/30/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"OpenShift Serverless","evidence":"/containers/cna/affected/31/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/32/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 3","evidence":"/containers/cna/affected/33/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/34/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 2","evidence":"/containers/cna/affected/35/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/36/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of OptaPlanner 8","evidence":"/containers/cna/affected/37/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus","evidence":"/containers/cna/affected/38/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus","evidence":"/containers/cna/affected/39/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/40/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Integration Camel K 1","evidence":"/containers/cna/affected/41/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Integration Camel Quarkus 2","evidence":"/containers/cna/affected/42/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Data Grid 7","evidence":"/containers/cna/affected/43/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/44/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Fuse Service Works 6","evidence":"/containers/cna/affected/45/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Process Automation 7","evidence":"/containers/cna/affected/46/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"streams for Apache Kafka","evidence":"/containers/cna/affected/47/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2024-1635","aliases":["CVE-2024-1635"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"versions":[{"status":"affected","version":"1.31.0"}],"packageName":"undertow","collectionURL":"https://github.com/undertow-io/undertow","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:apache_camel_spring_boot:4.4::el6"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7.13"],"vendor":"Red Hat","product":"Red Hat Fuse 7.13.0","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:1.5.5.016-1.redhat_00001.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-activemq-artemis","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"1:1.5.5.016-1.redhat_00001.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-artemis-native","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:3.5.11-1.Final_redhat_00001.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jboss-xnio-base","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:1.14.2-1.redhat_00002.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jsoup","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:1.4.18-14.SP13_redhat_00001.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.1.10-2.GA_redhat_00002.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:5.0.3-2.redhat_00002.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-woodstox-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.0.10-2.redhat_00002.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-xml-security","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.10.4-3.redhat_00006.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jackson-annotations","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.10.4-3.redhat_00006.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jackson-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.10.4-5.redhat_00006.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jackson-databind","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.10.4-3.redhat_00006.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jackson-jaxrs-providers","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.10.4-5.redhat_00006.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jackson-modules-base","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.10.4-2.redhat_00006.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jackson-modules-java8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:1.7.2-16.Final_redhat_00017.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-jboss-server-migration","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:4.1.63-5.Final_redhat_00003.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-netty","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:2.0.41-4.SP5_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.3.14-3.GA_redhat_00002.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:1.10.17-1.Final_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly-elytron","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4.16","versions":[{"status":"unaffected","version":"2.2.30.SP1-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.undertow/undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8","versions":[{"status":"unaffected","version":"0:2.2.30-1.SP1_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9","versions":[{"status":"unaffected","version":"0:2.2.30-1.SP1_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7","versions":[{"status":"unaffected","version":"0:2.2.30-1.SP1_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6 for RHEL 7","versions":[{"status":"unaffected","version":"0:18.0.13-1.redhat_00001.1.el7sso","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso7-keycloak","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6 for RHEL 8","versions":[{"status":"unaffected","version":"0:18.0.13-1.redhat_00001.1.el8sso","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso7-keycloak","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6 for RHEL 9","versions":[{"status":"unaffected","version":"0:18.0.13-1.redhat_00001.1.el9sso","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso7-keycloak","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:rhosemc:1.0::el8"],"vendor":"Red Hat","product":"RHEL-8 based Middleware Containers","versions":[{"status":"unaffected","version":"7.6-46","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso-7/sso76-openshift-rhel8","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6"],"vendor":"Red Hat","product":"RHSSO 7.6.8","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:serverless:1"],"vendor":"Red Hat","product":"OpenShift Serverless","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 3","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:service_registry:2"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 2","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:optaplanner:::el6"],"vendor":"Red Hat","product":"Red Hat build of OptaPlanner 8","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:2"],"vendor":"Red Hat","product":"Red Hat build of Quarkus","packageName":"quarkus-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Quarkus","packageName":"quarkus-undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:integration:1"],"vendor":"Red Hat","product":"Red Hat Integration Camel K 1","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:camel_quarkus:2"],"vendor":"Red Hat","product":"Red Hat Integration Camel Quarkus 2","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:7"],"vendor":"Red Hat","product":"Red Hat JBoss Data Grid 7","packageName":"undertow","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"undertow-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_fuse_service_works:6"],"vendor":"Red Hat","product":"Red Hat JBoss Fuse Service Works 6","packageName":"undertow","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_streams:1"],"vendor":"Red Hat","product":"streams for Apache Kafka","packageName":"undertow","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"}],"modified":"2026-10-07T21:29:54.592Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2024:1674","https://access.redhat.com/errata/RHSA-2024:1675","https://access.redhat.com/errata/RHSA-2024:1676","https://access.redhat.com/errata/RHSA-2024:1677","https://access.redhat.com/errata/RHSA-2024:1860","https://access.redhat.com/errata/RHSA-2024:1861","https://access.redhat.com/errata/RHSA-2024:1862","https://access.redhat.com/errata/RHSA-2024:1864","https://access.redhat.com/errata/RHSA-2024:1866","https://access.redhat.com/errata/RHSA-2024:3354","https://access.redhat.com/errata/RHSA-2024:4884","https://access.redhat.com/errata/RHSA-2025:4226","https://access.redhat.com/errata/RHSA-2025:9583","https://access.redhat.com/security/cve/CVE-2024-1635","https://bugzilla.redhat.com/show_bug.cgi?id=2264928"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-1635","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-02-22T16:54:05.178381Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-05T13:50:19.172Z"}},{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:1674","name":"RHSA-2024:1674","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1675","name":"RHSA-2024:1675","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1676","name":"RHSA-2024:1676","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1677","name":"RHSA-2024:1677","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1860","name":"RHSA-2024:1860","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1861","name":"RHSA-2024:1861","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1862","name":"RHSA-2024:1862","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1864","name":"RHSA-2024:1864","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1866","name":"RHSA-2024:1866","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1635","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264928","name":"RHBZ#2264928","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20240322-0007/","tags":["x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-01T18:48:21.580Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-07T21:29:54.592Z"}}},"related_cves":[{"value":"CVE-2024-1635","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9414,"advisory_id":"8cdcbb41-d73c-40df-9d29-e11bae35168d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-0603","source_published_at":"2026-01-23T06:31:38.975+00:00","published_at":"2026-10-24T23:17:30.828898+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-build-of-optaplanner-8","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-7-1-eus-for-rhel-7","red-hat-jboss-enterprise-application-platform-7-3-eus-for-rhel-7","red-hat-jboss-enterprise-application-platform-7-4-24","red-hat-jboss-enterprise-application-platform-7-4-els-on-rhel-7","red-hat-jboss-enterprise-application-platform-7-4-els-on-rhel-8","red-hat-jboss-enterprise-application-platform-7-4-els-on-rhel-9","red-hat-jboss-enterprise-application-platform-8","red-hat-jboss-enterprise-application-platform-expansion-pack","red-hat-openshift-ai-rhoai","red-hat-openshift-dev-spaces","red-hat-process-automation-7","red-hat-satellite-6","red-hat-single-sign-on-7-6-13","red-hat-single-sign-on-7-6-for-rhel-7","red-hat-single-sign-on-7-6-for-rhel-8","red-hat-single-sign-on-7-6-for-rhel-9","rhel-8-based-middleware-containers"],"cve_ids":["CVE-2026-0603"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection","summary":"A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.","evidence":"cve:CVE-2026-0603","products":[{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4.24","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6.13","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6 for RHEL 7","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6 for RHEL 8","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6 for RHEL 9","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"RHEL-8 based Middleware Containers","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of OptaPlanner 8","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift AI (RHOAI)","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift AI (RHOAI)","evidence":"/containers/cna/affected/25/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/26/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/27/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Process Automation 7","evidence":"/containers/cna/affected/28/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Satellite 6","evidence":"/containers/cna/affected/29/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Satellite 6","evidence":"/containers/cna/affected/30/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-0603","aliases":["CVE-2026-0603"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"versions":[{"status":"affected","version":"5.2.8","versionType":"semver","lessThanOrEqual":"5.6.15"}],"packageName":"org.hibernate/hibernate-core","collectionURL":"https://github.com/hibernate/hibernate-orm","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:5.1.17-4.Final_redhat_00005.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.1.14-4.GA_redhat_00003.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.3.17-5.GA_redhat_00006.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4.24","versions":[{"status":"unaffected","version":"5.3.38.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"org.hibernate/hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6.13","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6 for RHEL 7","versions":[{"status":"unaffected","version":"0:18.0.20-1.redhat_00001.1.el7sso","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso7-keycloak","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6 for RHEL 8","versions":[{"status":"unaffected","version":"0:18.0.20-1.redhat_00001.1.el8sso","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso7-keycloak","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6 for RHEL 9","versions":[{"status":"unaffected","version":"0:18.0.20-1.redhat_00001.1.el9sso","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso7-keycloak","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:rhosemc:1.0::el8"],"vendor":"Red Hat","product":"RHEL-8 based Middleware Containers","versions":[{"status":"unaffected","version":"7.6-85","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso-7/sso76-openshift-rhel8","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:optaplanner:::el6"],"vendor":"Red Hat","product":"Red Hat build of OptaPlanner 8","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-trustyai-service-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-trustyai-service-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/openvsx-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/pluginregistry-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:satellite:6"],"vendor":"Red Hat","product":"Red Hat Satellite 6","packageName":"candlepin","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:satellite:6"],"vendor":"Red Hat","product":"Red Hat Satellite 6","packageName":"satellite:el8/candlepin","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"}],"modified":"2026-10-06T16:58:42.598Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:4915","https://access.redhat.com/errata/RHSA-2026:4916","https://access.redhat.com/errata/RHSA-2026:4917","https://access.redhat.com/errata/RHSA-2026:4924","https://access.redhat.com/errata/RHSA-2026:6011","https://access.redhat.com/errata/RHSA-2026:6012","https://access.redhat.com/errata/RHSA-2026:76128","https://access.redhat.com/errata/RHSA-2026:76129","https://access.redhat.com/errata/RHSA-2026:76130","https://access.redhat.com/errata/RHSA-2026:76132","https://access.redhat.com/errata/RHSA-2026:76134","https://access.redhat.com/security/cve/CVE-2026-0603","https://bugzilla.redhat.com/show_bug.cgi?id=2427147"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-0603","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-01-24T04:55:25.177681Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-02-26T14:44:24.608Z"}},{"title":"org.hibernate/hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:5.1.17-4.Final_redhat_00005.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.1.14-4.GA_redhat_00003.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.3.17-5.GA_redhat_00006.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4.24","versions":[{"status":"unaffected","version":"5.3.38.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"org.hibernate/hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:optaplanner:::el6"],"vendor":"Red Hat","product":"Red Hat build of OptaPlanner 8","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-trustyai-service-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-trustyai-service-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/openvsx-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/pluginregistry-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:satellite:6"],"vendor":"Red Hat","product":"Red Hat Satellite 6","packageName":"candlepin","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:satellite:6"],"vendor":"Red Hat","product":"Red Hat Satellite 6","packageName":"satellite:el8/candlepin","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"timeline":[{"lang":"en","time":"2026-01-05T13:12:29.816Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-01-19T10:10:00.000Z","value":"Made public."}],"solutions":[{"lang":"en","value":"RHSA-2026:6012: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server"},{"lang":"en","value":"RHSA-2026:6011: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server"},{"lang":"en","value":"RHSA-2026:4915: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"},{"lang":"en","value":"RHSA-2026:4916: Red Hat JBoss EAP 7.4 ELS for RHEL 8"},{"lang":"en","value":"RHSA-2026:4917: Red Hat JBoss EAP 7.4 ELS for RHEL 9"},{"lang":"en","value":"RHSA-2026:4924: Red Hat JBoss Enterprise Application Platform 7.4.24"}],"x_adpType":"supplier","datePublic":"2026-01-19T10:10:00.000Z","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-0603","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2427147","name":"RHBZ#2427147","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0603.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6012","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6011","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:4915","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:4916","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:4917","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:4924","tags":["vendor-advisory","x_refsource_REDHAT"]}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_generator":{"engine":"sadp-cli 1.0.0"},"descriptions":[{"lang":"en","value":"A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service."}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","shortName":"redhat-SADP","dateUpdated":"2026-09-14T12:04:32.444Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-06T16:58:42.598Z"}}},"related_cves":[{"value":"CVE-2026-0603","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":29871,"next_before":9414}