RHSA-2025:9583HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.14 Security update

Published
June 25, 2025
Last Modified
August 10, 2026

🔗 CVE IDs covered (14)

CVE-2024-1233 →CVE-2022-1259 →CVE-2022-2053 →CVE-2022-3143 →CVE-2022-4492 →CVE-2023-1108 →CVE-2023-3223 →CVE-2023-5379 →CVE-2024-1635 →CVE-2020-36518 →CVE-2021-37136 →CVE-2021-37137 →CVE-2022-1319 →CVE-2023-1973 →

📋 Description

CVE-2020-36518 — jackson-databind: denial of service via a large depth of nested objects CVE-2021-37136 — netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data CVE-2021-37137 — netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way CVE-2022-1259 — undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629) CVE-2022-1319 — undertow: Double AJP response for 400 from EAP 7 results in CPING failures CVE-2022-2053 — undertow: Large AJP request may cause DoS CVE-2022-3143 — wildfly-elytron: possible timing attacks via use of unsafe comparator CVE-2022-4492 — undertow: Server identity in https connection is not checked by the undertow client CVE-2023-1108 — Undertow: Infinite loop in SslConduit during close CVE-2023-1973 — undertow: unrestricted request storage leads to memory exhaustion CVE-2023-3223 — undertow: OutOfMemoryError due to @MultipartConfig handling CVE-2023-5379 — undertow: AJP Request closes connection exceeding maxRequestSize CVE-2024-1233 — EAP: wildfly-elytron has a SSRF security issue CVE-2024-1635 — undertow: Out-of-memory Error after several closed connections with wildfly-http-client protocol

🎯 Affected products54

  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-annotations-0:2.10.4-3.redhat_00006.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-annotations-0:2.10.4-3.redhat_00006.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-core-0:2.10.4-3.redhat_00006.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-core-0:2.10.4-3.redhat_00006.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-databind-0:2.10.4-5.redhat_00006.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-databind-0:2.10.4-5.redhat_00006.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-datatype-jdk8-0:2.10.4-2.redhat_00006.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-datatype-jsr310-0:2.10.4-2.redhat_00006.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-jaxrs-base-0:2.10.4-3.redhat_00006.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-jaxrs-json-provider-0:2.10.4-3.redhat_00006.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-jaxrs-providers-0:2.10.4-3.redhat_00006.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-module-jaxb-annotations-0:2.10.4-5.redhat_00006.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-modules-base-0:2.10.4-5.redhat_00006.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-modules-base-0:2.10.4-5.redhat_00006.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-modules-java8-0:2.10.4-2.redhat_00006.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jackson-modules-java8-0:2.10.4-2.redhat_00006.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jboss-server-migration-0:1.7.2-16.Final_redhat_00017.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jboss-server-migration-0:1.7.2-16.Final_redhat_00017.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jboss-server-migration-cli-0:1.7.2-16.Final_redhat_00017.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jboss-server-migration-core-0:1.7.2-16.Final_redhat_00017.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jboss-server-migration-eap6.4-0:1.7.2-16.Final_redhat_00017.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jboss-server-migration-eap6.4-to-eap7.3-0:1.7.2-16.Final_redhat_00017.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jboss-server-migration-eap7.0-0:1.7.2-16.Final_redhat_00017.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jboss-server-migration-eap7.1-0:1.7.2-16.Final_redhat_00017.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jboss-server-migration-eap7.2-0:1.7.2-16.Final_redhat_00017.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jboss-server-migration-eap7.2-to-eap7.3-0:1.7.2-16.Final_redhat_00017.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jboss-server-migration-eap7.3-server-0:1.7.2-16.Final_redhat_00017.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jboss-server-migration-wildfly10.0-0:1.7.2-16.Final_redhat_00017.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • eap7-jboss-server-migration-wildfly10.1-0:1.7.2-16.Final_redhat_00017.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
  • +24 more not shown

✅ Remediation

Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No mitigation is currently available for this vulnerability. However, there might be some protections, such as request limits by a load balancer in front of JBoss EAP/Wildfly or even Undertow, that could minimize the impact.

🔗 References (22)