RHSA-2025:17317HighCVSS 8.3

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.9 security update

Published
October 2, 2025
Last Modified
August 19, 2026

🔗 CVE IDs covered (3)

CVE-2025-55163 →CVE-2025-58056 →CVE-2025-48913 →

📋 Description

CVE-2025-48913 — org.apache.cxf/cxf: CXF JMS Code Execution Vulnerability CVE-2025-55163 — netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability CVE-2025-58056 — netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

🎯 Affected products134

  • Red Hat JBoss EAP 8.0 for RHEL 8
  • Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-apache-cxf-0:4.0.9-5.redhat_00002.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-apache-cxf-0:4.0.9-5.redhat_00002.1.el8eap.src as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-apache-cxf-0:4.0.9-5.redhat_00002.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-apache-cxf-0:4.0.9-5.redhat_00002.1.el9eap.src as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-apache-cxf-rt-0:4.0.9-5.redhat_00002.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-apache-cxf-rt-0:4.0.9-5.redhat_00002.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-apache-cxf-services-0:4.0.9-5.redhat_00002.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-apache-cxf-services-0:4.0.9-5.redhat_00002.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-apache-cxf-tools-0:4.0.9-5.redhat_00002.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-apache-cxf-tools-0:4.0.9-5.redhat_00002.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-apache-cxf-xjc-utils-0:4.1.0-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-apache-cxf-xjc-utils-0:4.1.0-1.redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-apache-cxf-xjc-utils-0:4.1.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-apache-cxf-xjc-utils-0:4.1.0-1.redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-cxf-xjc-boolean-0:4.1.0-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-cxf-xjc-boolean-0:4.1.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-cxf-xjc-bug986-0:4.1.0-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-cxf-xjc-bug986-0:4.1.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-cxf-xjc-dv-0:4.1.0-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-cxf-xjc-dv-0:4.1.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-cxf-xjc-runtime-0:4.1.0-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-cxf-xjc-runtime-0:4.1.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-cxf-xjc-ts-0:4.1.0-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-cxf-xjc-ts-0:4.1.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-eap-product-conf-parent-0:800.9.1-3.GA_redhat_00004.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-eap-product-conf-parent-0:800.9.1-3.GA_redhat_00004.1.el8eap.src as a component of Red Hat JBoss EAP 8.0 for RHEL 8
  • eap8-eap-product-conf-parent-0:800.9.1-3.GA_redhat_00004.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • eap8-eap-product-conf-parent-0:800.9.1-3.GA_redhat_00004.1.el9eap.src as a component of Red Hat JBoss EAP 8.0 for RHEL 9
  • +104 more not shown

✅ Remediation

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To reduce risk, deployments should restrict the allowed protocols in JMS configuration to trusted and expected values only. In particular, disallow the use of rmi:// and ldap:// URLs, which could be abused for remote class loading and code execution. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: To mitigate this issue, enforce strict RFC compliance on all front-end proxies and load balancers so that lone LF characters in chunk extensions are rejected or normalized before being forwarded. Additionally, configure input validation at the application or proxy layer to block malformed chunked requests, ensuring consistent parsing across all components in the request path.

🔗 References (18)