Red hat jboss enterprise application platform 7

This hub aggregates every CVE we track for Red hat jboss enterprise application platform 7, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Red hat jboss enterprise application platform 7.

• CVE-2026-93562Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling6.5Sep 18, 2026
• CVE-2026-93574Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing6.5Sep 18, 2026
• CVE-2026-93579Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)6.5Sep 18, 2026
• CVE-2026-93573Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling6.5Sep 18, 2026
• CVE-2026-93568Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests7.5Sep 18, 2026
• CVE-2026-93576Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)7.5Sep 18, 2026
• CVE-2026-85511Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth24.2Sep 18, 2026
• CVE-2026-93569Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority8.2Sep 18, 2026
• CVE-2026-93567Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority7.5Sep 18, 2026
• CVE-2026-93566Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line6.5Sep 18, 2026
• CVE-2026-10832Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload5.9Sep 18, 2026
• CVE-2026-93565Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte7.5Sep 18, 2026
• CVE-2026-93564Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)7.5Sep 18, 2026
• CVE-2026-93558Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service7.5Sep 18, 2026
• CVE-2026-93560Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos7.5Sep 18, 2026