RHSA-2026:95221HighCVSS 9.0

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 XP 6.0.7.GA release

Published
November 4, 2026
Last Modified
November 11, 2026

🔗 CVE IDs covered (23)

CVE-2026-89046 →CVE-2026-93567 →CVE-2026-17615 →CVE-2026-59903 →CVE-2026-59969 →CVE-2026-84501 →CVE-2026-87824 →CVE-2026-87825 →CVE-2026-59296 →CVE-2026-89058 →CVE-2026-89059 →CVE-2026-90560 →CVE-2026-90852 →CVE-2026-93579 →CVE-2026-66274 →CVE-2026-87877 →CVE-2026-93492 →CVE-2026-93568 →CVE-2026-93569 →CVE-2026-66257 →CVE-2026-66273 →CVE-2026-68497 →CVE-2026-87795 →

📋 Description

CVE-2026-17615 — resteasy-core: RESTeasy SourceProvider remote unauthenticated file read CVE-2026-59296 — io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing CVE-2026-59903 — io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite CVE-2026-59969 — zookeeper: Apache ZooKeeper: Improper certificate validation in FIPS mode allows quorum compromise CVE-2026-66257 — qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching CVE-2026-66273 — org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation CVE-2026-66274 — org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting CVE-2026-68497 — com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing CVE-2026-84501 — zookeeper: Apache ZooKeeper: Operational log forgery via newline injection CVE-2026-87795 — com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service CVE-2026-87824 — com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect CVE-2026-87825 — com.github.luben/zstd-jni: zstd-jni: Data corruption or denial of service via use-after-free vulnerability CVE-2026-87877 — com.github.luben/zstd-jni: zstd-jni: Use-After-Free vulnerability allows memory corruption and denial of service CVE-2026-89046 — zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read CVE-2026-89058 — resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config CVE-2026-89059 — resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) CVE-2026-90560 — com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress CVE-2026-90852 — com.github.luben/zstd-jni: luben zstd-jni: Remote use-after-free vulnerability in dictionary sharing CVE-2026-93492 — io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size CVE-2026-93567 — io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority CVE-2026-93568 — io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests CVE-2026-93569 — io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority CVE-2026-93579 — io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)

🎯 Affected products1

  • Red Hat JBoss Enterprise Application Platform 8.1

✅ Remediation

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, avoid exposing RESTEasy endpoints that return Source or StreamSource types. Alternatively, implement a custom MessageBodyWriter for Source types that explicitly applies XML security features to the SAXParserFactory before parsing. Changes to application configuration or code typically require an application redeployment or restart to take effect. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Update to Apache ZooKeeper 3.8.7, 3.9.6, or later. As a workaround, disable FIPS mode if not required by compliance policies. Workaround: To mitigate this issue, restrict network access to services utilizing Apache Qpid Proton-J to trusted clients and networks only. Implement firewall rules to limit inbound connections to the specific ports used by these services. This operational control reduces the attack surface by preventing untrusted external access, but may impact legitimate client connectivity if not carefully configured. Workaround: Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity. Workaround: Update to Apache ZooKeeper 3.8.7, 3.9.6, or later. Workaround: Update com.github.luben/zstd-jni to version 1.5.7-14 or later. Until updated, do not pass attacker-controlled offset or length values to ZstdDictCompress. Workaround: No complete workaround is currently available. As a temporary measure, applications using Zstd.trainFromBufferDirect() should validate that all sample lengths are non-negative and that their total does not exceed the capacity of the samples buffer before calling the function. Avoid passing attacker-controlled sample length arrays to this function until an update is available. Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available. Workaround: No complete workaround is currently available. As a temporary measure, applications using zstd-jni should not call setDict(), setLongMax(), setLevel(), or setRefMultipleDDicts() on a stream after close(). Upgrade to a Red Hat product release containing zstd-jni 1.5.7-14 or later when available. Workaround: Update to a product release containing zstd-jni 1.5.7-14 or later. Until updated, validate source positions and reject negative offsets before calling Zstd.getFrameContentSize. Do not pass attacker-controlled offsets to this method without validation. Workaround: Until a fixed update is available, applications should validate that dictionary offset and length values are non-negative and that the requested range does not exceed the dictionary array. Apply product updates containing zstd-jni 1.5.7-14 or a Red Hat backport of the fix when available. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72 for fixed versions and remediation guidance.

🔗 References (42)