CVE-2026-114488

Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding

A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Redhat Wildfly

Products

Fuse 7 Jboss Enterprise Application Platform Jboss Enterprise Application Platform Expansion Pack and 5 more

CVE-2026-93574

Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing

A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Amq Broker Amq Clients and 19 more

CVE-2026-93573

Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling

A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Amq Broker Amq Clients and 19 more

CVE-2026-93568

Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Amq Broker Apache Camel Quarkus and 21 more

CVE-2026-93488

Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Amq Broker Amq Clients and 20 more

CVE-2026-24330

Wildfly-core: wildfly: arbitrary file read via malicious archive deployment

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Fuse 7 Jboss Bpms Jboss Enterprise Application Platform and 7 more

CVE-2026-24329

Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file. Manual intervention is required to restore server operation, leading to a denial of service.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Fuse 7 Jboss Bpms Jboss Enterprise Application Platform and 6 more

CVE-2026-14180

Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.

CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Redhat

Products

Apache Camel Hawtio Build Of Apache Camel - Hawtio Build Of Apache Camel For Spring Boot and 11 more

CVE-2026-50633

Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Cxf Build Of Apache Camel Fuse

CVE-2026-50628

Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Cxf Build Of Apache Camel Fuse and 1 more

CVE-2026-50632

Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Cxf Build Of Apache Camel Enterprise Linux and 3 more

CVE-2026-50627

Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

CVSS 3.1 · 9.1 Critical EPSS 4.1% KEV · Not listed

Vendors

Apache Redhat

Products

Cxf Build Of Apache Camel Fuse and 1 more

CVE-2026-28369

Undertow: undertow: request smuggling via malformed http request headers

A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Apache Camel Hawtio Build Of Apache Camel - Hawtio Build Of Apache Camel For Spring Boot and 14 more

CVE-2026-28368

Undertow: undertow: request smuggling via inconsistent header parsing

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Apache Camel Hawtio Build Of Apache Camel - Hawtio Build Of Apache Camel For Spring Boot and 14 more

CVE-2026-28367

Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Apache Camel Hawtio Build Of Apache Camel - Hawtio Build Of Apache Camel For Spring Boot and 14 more

CVE-2025-12543

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

CVSS 3.1 · 9.6 Critical EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Apache Camel Hawtio Apache Camel Spring Boot Build Of Apache Camel and 16 more

CVE-2025-9784

Undertow: undertow madeyoureset http/2 ddos vulnerability

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed

Vendors

Redhat

Products

Apache Camel Hawtio Apache Camel Spring Boot Build Of Apache Camel For Spring Boot and 15 more

CVE-2024-1635

Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed

Vendors

Netapp Redhat

Products

Active Iq Unified Manager Oncommand Workflow Automation Amq Streams and 23 more

CVE-2026-119542

Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Infinispan Redhat

Products

Infinispan Build Of Apache Camel For Quarkus Camel Quarkus and 7 more

CVE-2026-15567

Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Fuse Jboss Enterprise Application Platform Jboss Enterprise Application Platform Els and 5 more