Red hat jboss enterprise application platform 7

This hub aggregates every CVE we track for Red hat jboss enterprise application platform 7, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Red hat jboss enterprise application platform 7.

• CVE-2026-17614Wildfly-core: path traversal on wildfly domain controller4.4Aug 4, 2026
• CVE-2025-12799Jastow: jastow cross-site scripting attack due to unsanitized uri6.5Jul 7, 2026
• CVE-2026-28367Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator8.7Mar 27, 2026
• CVE-2026-28369Undertow: undertow: request smuggling via malformed http request headers8.7Mar 27, 2026
• CVE-2026-28368Undertow: undertow: request smuggling via inconsistent header parsing8.7Mar 27, 2026
• CVE-2024-4027Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks7.5Jan 30, 2026
• CVE-2025-5731Infinispan: credential leakage in infinispan cli5.5Jun 26, 2025
• CVE-2025-2240Smallrye-fault-tolerance: smallrye fault tolerance7.5Mar 12, 2025
• CVE-2025-23368Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli8.1Mar 4, 2025
• CVE-2024-11831Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript5.4Feb 10, 2025
• CVE-2025-23367Org.wildfly.core:wildfly-server: wildfly improper rbac permission6.5Jan 30, 2025
• CVE-2025-23366Org.jboss.hal:hal-console: wildfly hal console cross-site scripting6.5Jan 14, 2025
• CVE-2024-8447Narayana: deadlock via multiple join requests sent to lra coordinator5.9Jan 2, 2025
• CVE-2024-12369Elytron-oidc-client: oidc authorization code injection4.2Dec 9, 2024
• CVE-2023-4639Undertow: cookie smuggling/spoofing7.4Nov 17, 2024