RHSA-2026:95887HighCVSS 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update

Published
November 6, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (40)

CVE-2026-14682 →CVE-2026-17614 →CVE-2026-19610 →CVE-2026-65432 →CVE-2026-56624 →CVE-2026-84375 →CVE-2026-100655 →CVE-2026-59903 →CVE-2026-69152 →CVE-2026-84725 →CVE-2026-85634 →CVE-2026-89058 →CVE-2026-93565 →CVE-2026-100666 →CVE-2026-114488 →CVE-2026-8763 →CVE-2026-59650 →CVE-2026-59651 →CVE-2026-66909 →CVE-2026-93562 →CVE-2026-15564 →CVE-2026-93488 →CVE-2026-93574 →CVE-2026-100656 →CVE-2026-12803 →CVE-2026-12816 →CVE-2026-57819 →CVE-2026-64958 →CVE-2026-65583 →CVE-2026-93491 →CVE-2026-93558 →CVE-2026-93573 →CVE-2026-17615 →CVE-2026-19611 →CVE-2026-58062 →CVE-2026-89059 →CVE-2026-93566 →CVE-2026-13506 →CVE-2026-15560 →CVE-2026-75595 →

📋 Description

CVE-2026-8763 — org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI CVE-2026-12803 — org.bouncycastle/bc-java: Bouncy Castle for Java: Authenticated Encryption Forgery Vulnerability CVE-2026-12816 — org.bouncycastle/bcprov-jdk15on: Bouncy Castle for Java: Message Authentication Code (MAC) forgery due to a length-dependent Key Derivation Function (KDF) split CVE-2026-13506 — bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing CVE-2026-14682 — org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcprov-jdk18on: org.bouncycastle/bc-fips: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service due to unbounded memory allocation CVE-2026-15560 — openjdk-orb: unauthed class loading via IIOP in EAP CVE-2026-15564 — wildfly-ejb: wildfly-iiop-openjdk: EAP IIOP listeners may permit unauthed deserialization CVE-2026-17614 — wildfly-core: Path Traversal on WildFly Domain Controller CVE-2026-17615 — resteasy-core: RESTeasy SourceProvider remote unauthenticated file read CVE-2026-19610 — wildfly-platform-mbean: wildfly-platform-mbean: RBAC sensitive attribute read bypass for platform RuntimeMxBean CVE-2026-19611 — wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding CVE-2026-56624 — org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation CVE-2026-57819 — Apache CXF: Apache CXF: Denial of Service via uncontrolled form parameters CVE-2026-58062 — org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcprov-jdk15on: Bouncy Castle for Java: Certificate validation bypass via stapled OCSP response CVE-2026-59650 — bouncycastle: Bouncy Castle for Java: Cryptographic key compromise due to unvalidated Diffie-Hellman peer value CVE-2026-59651 — org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcprov-jdk18on: Bouncy Castle for Java: Weak integrity protection in BKS keystore CVE-2026-59903 — io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite CVE-2026-64958 — org.apache.cxf/cxf: Apache CXF: Denial of service via many attachment headers CVE-2026-65432 — Apache CXF: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing CVE-2026-65583 — org.apache.cxf/cxf: Apache CXF: Authentication Bypass via Crafted OIDC Self-Issued ID Tokens CVE-2026-66909 — org.apache.cxf/cxf: Apache CXF: Remote Code Execution via unsafe deserialization of JMS ObjectMessage CVE-2026-69152 — brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVE-2026-75595 — io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing CVE-2026-84725 — openjdk-orb: Incomplete fix for CVE-2026-15560,unauthed class loading via IIOP in EAP CVE-2026-85634 — wildfly-core: wildfly-core: Deployer RBAC role privilege escalation via path traversal in deployment name CVE-2026-89058 — resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config CVE-2026-89059 — resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) CVE-2026-93488 — io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams CVE-2026-93491 — io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue CVE-2026-93558 — io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service CVE-2026-93562 — io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling CVE-2026-93565 — io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte CVE-2026-93566 — io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line CVE-2026-93573 — io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling CVE-2026-93574 — io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing CVE-2026-100655 — io.netty/netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams CVE-2026-100656 — io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining CVE-2026-100666 — io.netty/netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodec CVE-2026-114488 — Wildfly: wildfly-iiop: wildfly-ejb3: Wildfly: Authentication bypass on IIOP EJB invocations as CSIv2 ITTPrincipalName accepted without transport binding

🎯 Affected products1

  • Red Hat JBoss Enterprise Application Platform 8.1

✅ Remediation

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85, LTS 2.73.12, BC-FJA bc-fips 1.0.2.7/2.0.2/2.1.3, or bctls-fips 1.0.24) once available for the affected product. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users of affected JBoss EAP streams should apply the openjdk-orb updates provided for their supported EAP version through the usual update channels. Workaround: Restrict network reachability to the IIOP listener (default TCP port 3528) so that only localhost or authorized management networks can access it. 1. Restrict port exposure using firewalld: ```bash firewall-cmd --permanent --remove-port=3528/tcp firewall-cmd --reload ``` 2. If CORBA/IIOP interoperability is not required by deployed applications, remove the IIOP subsystem using the JBoss Management CLI: ```bash jboss-cli.sh --connect --command="/subsystem=iiop-openjdk:remove" ``` Caveats: Removing the IIOP subsystem will break remote EJB invocations or external services that rely on CORBA/IIOP protocols. Warning: Applying firewall changes or removing server subsystems will disrupt active client connections and requires reloading the server configuration or restarting the JBoss EAP service to take full effect. Workaround: To mitigate this issue, avoid exposing RESTEasy endpoints that return Source or StreamSource types. Alternatively, implement a custom MessageBodyWriter for Source types that explicitly applies XML security features to the SAXParserFactory before parsing. Changes to application configuration or code typically require an application redeployment or restart to take effect. Workaround: Update Apache CXF to the latest version that includes the fix. Configure form parameter limits in application settings to prevent resource exhaustion attacks. Workaround: Where Bouncy Castle performs PKIX revocation checking with stapled OCSP, pin expected peer certificate or public-key fingerprints ([CME-404](https://cmetaxonomy.org/entries/CME-404.html)) so a stapled OCSP response for a different serial cannot substitute trust. Restrict TLS clients to trusted networks and peers ([CME-202](https://cmetaxonomy.org/entries/CME-202.html), [CME-203](https://cmetaxonomy.org/entries/CME-203.html)) to reduce man-in-the-middle opportunity against revoked certificates. If stapled OCSP is not required, avoid PKIXRevocationChecker.setOcspResponses() and use CRL or online OCSP fetch paths that enforce CertID binding. Upgrade to Bouncy Castle 1.85 or later (BC-LTS 2.73.12, or bc-fips 2.0.2 / 2.1.3) when available. Workaround: Red Hat is not aware of a mitigation for this flaw other than updating the affected Bouncy Castle component to a fixed version (bc-java 1.85 or LTS 2.73.12) once available for the affected product. Workaround: Update Apache CXF to a version that includes the fix. Disable DTD processing and external entity resolution in XML parsers. Avoid processing untrusted WSDL/XSD imports. Workaround: Keep the default behavior of the Apache CXF OIDC relying-party token validator: self-issued ID tokens are not accepted by default, so deployments that have not enabled their acceptance are not exposed to this authentication bypass. Deployments that have enabled acceptance of self-issued ID tokens can mitigate the issue by disabling that configuration. As a longer-term resolution, upgrading to an upstream Apache CXF version containing the fix (4.2.3, 4.1.8, or 3.6.12, as recommended in the Apache advisory) is advised. Workaround: To mitigate this vulnerability, disable ObjectMessage deserialization in Apache CXF's JMS transport. This can typically be achieved through a configuration setting provided by the Apache CXF framework. Consult the Apache CXF documentation for specific instructions on how to disable ObjectMessage deserialization in your deployment. Disabling this feature may impact applications that rely on ObjectMessage for legitimate data transfer. Workaround: To mitigate this vulnerability, do not pass untrusted input to the expand() function. Workaround: To mitigate this issue, ensure that application-layer certificate verification is implemented for services utilizing Netty with mutual TLS. This provides an additional layer of authentication beyond the TLS handshake, preventing unauthorized access even if the SNI routing is bypassed and a less restrictive default SslContext is used. Workaround: To mitigate this flaw, restrict access to the IIOP service (TCP port 3528) to trusted networks using firewall rules, or disable the IIOP subsystem if CORBA is not required by deployed applications. To restrict or remove external access to port 3528 using firewalld: ``` firewall-cmd --permanent --remove-port=3528/tcp firewall-cmd --reload ``` Warning: Reloading the firewall configuration may briefly interrupt network traffic. If removing the iiop-openjdk subsystem from the JBoss EAP configuration (standalone.xml or domain.xml), a full server restart is required, causing temporary service downtime. Caveats: Blocking port 3528 or disabling the IIOP subsystem will prevent legitimate remote clients from communicating over IIOP/CORBA Workaround: See https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698 for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw for fixed versions and remediation guidance. Workaround: See https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc for fixed versions and remediation guidance. Workaround: Update to io.netty:netty-codec-http version 4.2.17.Final or 4.1.137.Final or later, which fixes the response queue management in HttpServerCodec to properly pair responses with their originating requests. Workaround: To mitigate this vulnerability without modifying binaries, apply one or more of the following operational and configuration controls: 1. Maintain or revert caller propagation to the default 'none' setting in the IIOP subsystem configuration: Run the following management CLI command: `/subsystem=iiop-openjdk:write-attribute(name=caller-propagation,value=none)` Ensure that application deployment descriptors (such as jboss-ejb3.xml) do not explicitly override caller propagation to 'supported'. 2. Restrict network reachability: Block external access to the CORBA/IIOP port (default TCP port 3528) using firewall rules, or restrict access strictly to trusted application networks: `firewall-cmd --remove-port=3528/tcp --permanent && firewall-cmd --reload` 3. Enforce transport-level security: If caller propagation is required for your architecture, configure the IIOP subsystem to require SSL/TLS with client certificate authentication by setting `server-requires-ssl="true"`, or enforce mand…

🔗 References (49)