Filtered by vendor Redhat Subscriptions
Filtered by product Jboss Fuse Subscriptions
Total 629 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-93565 2 Red Hat, Redhat 23 Red Hat Amq Broker 7, Amq Broker, Amq Clients and 20 more 2026-11-06 7.5 High
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
CVE-2026-93558 2 Io.netty, Redhat 24 Netty-codec-http, Amq Broker, Amq Broker 7 and 21 more 2026-11-06 7.5 High
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.
CVE-2026-93491 2 Io.netty, Redhat 23 Netty-codec-http, Amq Broker, Amq Broker 7 and 20 more 2026-11-06 7.5 High
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.
CVE-2026-93488 2 Io.netty, Redhat 23 Netty-codec-http, Amq Broker, Amq Clients and 20 more 2026-11-06 7.5 High
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.
CVE-2026-89059 1 Redhat 27 Apache Camel Quarkus, Apicurio Registry, Build Keycloak and 24 more 2026-11-06 7.5 High
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
CVE-2026-85634 1 Redhat 4 Jboss Enterprise Application Platform, Jboss Fuse, Jbosseapxp and 1 more 2026-11-06 8.8 High
A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.
CVE-2026-17615 1 Redhat 22 Apache Camel Quarkus, Apicurio Registry, Build Keycloak and 19 more 2026-11-06 7.5 High
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
CVE-2024-4029 1 Redhat 7 Build Keycloak, Jboss Bpms, Jboss Data Grid and 4 more 2026-11-06 4.1 Medium
A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections.
CVE-2024-3653 1 Redhat 17 Amq Streams, Apache Camel Hawtio, Build Keycloak and 14 more 2026-11-06 5.3 Medium
A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.
CVE-2026-93579 2 Io.netty, Redhat 23 Netty-codec-http2, Amq Broker, Apicurio Registry and 20 more 2026-11-06 6.5 Medium
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.
CVE-2026-93574 2 Io.netty, Redhat 22 Netty-codec-http, Amq Broker, Amq Clients and 19 more 2026-11-06 6.5 Medium
A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.
CVE-2026-93573 2 Io.netty, Redhat 22 Netty-codec-http, Amq Broker, Amq Clients and 19 more 2026-11-06 6.5 Medium
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.
CVE-2026-93566 2 Red Hat, Redhat 22 Red Hat Amq Broker 7, Amq Broker, Amq Clients and 19 more 2026-11-06 6.5 Medium
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
CVE-2026-93562 2 Io.netty, Redhat 22 Netty-codec-http, Amq Broker, Amq Clients and 19 more 2026-11-06 6.5 Medium
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.
CVE-2026-93492 2 Io.netty, Redhat 24 Netty-codec-http2, Amq Broker, Amq Broker 7 and 21 more 2026-11-06 5.3 Medium
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).
CVE-2026-96453 1 Redhat 7 Amq Broker, Build Keycloak, Jboss Enterprise Application Platform and 4 more 2026-11-06 8 High
A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.
CVE-2026-93998 1 Redhat 7 Amq Broker, Build Keycloak, Jboss Enterprise Application Platform and 4 more 2026-11-06 7.4 High
A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.
CVE-2026-93569 2 Io.netty, Redhat 23 Netty-codec-http, Amq Broker, Apache Camel Quarkus and 20 more 2026-11-06 8.2 High
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
CVE-2026-93568 2 Io.netty, Redhat 24 Netty-codec-http, Amq Broker, Apache Camel Quarkus and 21 more 2026-11-06 7.5 High
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.
CVE-2026-93567 2 Io.netty, Redhat 24 Netty-codec-http2, Amq Broker, Apache Camel Quarkus and 21 more 2026-11-06 7.5 High
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.