RHSA-2026:49701HighCVSS 8.7

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.7 security update

Published
August 3, 2026
Last Modified
September 16, 2026

🔗 CVE IDs covered (11)

CVE-2026-47691 →CVE-2026-42581 →CVE-2026-44249 →CVE-2026-45674 →CVE-2026-50010 →CVE-2026-42578 →CVE-2026-42579 →CVE-2026-42584 →CVE-2026-42585 →CVE-2026-42587 →CVE-2026-45416 →

📋 Description

CVE-2026-42578 — netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation CVE-2026-42579 — netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement CVE-2026-42581 — netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers CVE-2026-42584 — netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion CVE-2026-42585 — netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing CVE-2026-42587 — netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression CVE-2026-44249 — netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation CVE-2026-45416 — netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake CVE-2026-45674 — netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation CVE-2026-47691 — io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records CVE-2026-50010 — netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

🎯 Affected products200

  • Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @adobe.css-tools-4.4.2 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @ampproject.remapping-2.3.0 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @asamuzakjp.css-color-2.8.3 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @ast-grep.napi-0.32.3 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @ast-grep.napi-linux-x64-gnu-0.32.3 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @ast-grep.napi-linux-x64-musl-0.32.3 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @axe-core.playwright-4.10.1 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.code-frame-7.26.2 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.compat-data-7.26.8 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.core-7.26.9 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.generator-7.26.9 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helper-annotate-as-pure-7.25.9 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helper-compilation-targets-7.26.5 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helper-create-class-features-plugin-7.26.9 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helper-member-expression-to-functions-7.25.9 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helper-module-imports-7.25.9 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helper-module-transforms-7.26.0 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helper-optimise-call-expression-7.25.9 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helper-plugin-utils-7.26.5 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helper-replace-supers-7.26.5 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helper-skip-transparent-expression-wrappers-7.25.9 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helper-string-parser-7.25.9 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helper-validator-identifier-7.25.9 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helper-validator-option-7.25.9 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.helpers-7.26.9 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.parser-7.26.10 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.parser-7.26.9 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.plugin-proposal-private-methods-7.18.6 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • @babel.runtime-7.26.10 as a component of Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • +170 more not shown

✅ Remediation

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Applications utilizing Netty's HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks. Workaround: To mitigate this issue, configure applications utilizing Netty's `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application's documentation for details on configuring Netty's TLS handler. A restart of the affected application or service is required for the configuration changes to take effect.

🔗 References (13)