RHSA-2026:18055HighCVSS 9.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update

Published
May 18, 2026
Last Modified
August 22, 2026

🔗 CVE IDs covered (14)

CVE-2025-14813 →CVE-2026-0636 →CVE-2026-3505 →CVE-2026-5588 →CVE-2026-26996 →CVE-2026-27830 →CVE-2026-33870 →CVE-2026-33871 →CVE-2025-23368 →CVE-2025-67030 →CVE-2026-5598 →CVE-2026-27446 →CVE-2026-27727 →CVE-2026-27904 →

📋 Description

CVE-2025-14813 — bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly CVE-2025-23368 — org.wildfly.core:wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI CVE-2025-67030 — org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2026-0636 — bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java CVE-2026-3505 — bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion CVE-2026-5588 — bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid CVE-2026-5598 — bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons CVE-2026-26996 — minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-27446 — org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication CVE-2026-27727 — com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects CVE-2026-27830 — c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects CVE-2026-27904 — minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions CVE-2026-33870 — io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values CVE-2026-33871 — netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood

🎯 Affected products110

  • Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-0:2.40.0-6.redhat_00012.1.el9eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-cli-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-commons-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-core-client-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-dto-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-hornetq-protocol-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-hqclient-protocol-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-jakarta-client-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-jakarta-ra-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-jakarta-server-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-jakarta-service-extensions-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-jdbc-store-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-journal-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-selector-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-activemq-artemis-server-0:2.40.0-6.redhat_00012.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-angus-0:2.0.5-1.redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-angus-activation-0:2.0.3-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-angus-activation-0:2.0.3-1.redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-angus-mail-0:2.0.5-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-bouncycastle-0:1.84.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-bouncycastle-0:1.84.0-1.redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-bouncycastle-jmail-0:1.84.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-bouncycastle-pg-0:1.84.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-bouncycastle-pkix-0:1.84.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-bouncycastle-prov-0:1.84.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-bouncycastle-util-0:1.84.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-eap-product-conf-parent-0:801.6.0-1.GA_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • eap8-eap-product-conf-parent-0:801.6.0-1.GA_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 9
  • +80 more not shown

✅ Remediation

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, strictly limit the payload encrypted under a single key and Initialization Vector (IV) pair using the GOSTCTR implementation and G3413CTRBlockCipher to a maximum of 255 blocks. Alternatively, transition to a more secure, standardized and authenticated encryption mode. Workaround: The effectiveness of an attack will also be dependent on the complexity of the usernames and passwords defined for the target installation. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this flaw, sanitize all user-supplied input to remove or escape LDAP special characters before passing it to the LDAPStoreHelper for directory queries. If the input contains unexpected metacharacters such as asterisks, parentheses or backslashes, reject the request or escape the characters. Workaround: To mitigate this vulnerability, enforce payload size limits on all incoming PGP messages before processing them. Additionally, apply memory quotas to the JVM or container environment to prevent a complete system outage in the event of memory exhaustion. Workaround: To mitigate this flaw, check that the signature sequence is not empty before passing any data to the CompositeVerifier for cryptographic validation. If the sequence is empty or null, explicitly reject the payload before it is processed. Workaround: To mitigate this vulnerability, implement aggressive rate limiting and anomaly detection, specifically looking for unusual, high-frequency cryptographic handshake failures or anomalous traffic patterns targeting endpoints that handle key exchanges in the network logs. Workaround: To mitigate this issue, restrict Core protocol support on acceptors receiving connections from untrusted sources. The default "artemis" acceptor on port 61616 supports all protocols, including Core. Modify the acceptor URL to explicitly exclude the Core protocol using the "protocols" URL parameter. Alternatively, configure two-way SSL with certificate-based authentication to prevent unauthenticated exploitation. A service restart or reload may be required for changes to take effect.

🔗 References (48)