Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 185

Export CSV
CVE-2026-93492

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Io.netty Redhat
Products
Netty-codec-http2 Amq Broker Amq Broker 7 and 21 more
CVE-2026-114488

Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding

A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat Wildfly
Products
Fuse 7 Jboss Enterprise Application Platform Jboss Enterprise Application Platform Expansion Pack and 5 more
CVE-2026-19611

Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.

CVSS 3.1 · 7.4 High EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Quarkus Build Keycloak Build Of Apache Camel For Quarkus and 12 more
CVE-2026-19610

Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control (RBAC) checks. This allows an authenticated user with low-privileged access, such as the Monitor role, to view sensitive system properties and JVM configuration details that should be restricted.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Application Platform Expansion Pack Jbosseapxp and 2 more
CVE-2026-17614

Wildfly-core: path traversal on wildfly domain controller

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A remote attacker who has obtained the slave host controller secret or compromised a slave host controller can supply a crafted relative path containing directory traversal sequences (e.g., ../../etc/passwd) via the slave-DC wire protocol, causing the Domain Controller to resolve and serve arbitrary files readable by the DC process. This leads to unauthorized disclosure of sensitive information such as configuration files, keystores, and system credentials.

CVSS 3.1 · 4.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Application Platform Expansion Pack Jbosseapxp and 1 more
CVE-2026-93998

Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer

A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. If multiple identity providers share the same trusted signing key, an attacker who controls one of those providers can create a validly signed assertion to log into the application as any user, potentially gaining full administrative control.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Build Keycloak Jboss Enterprise Application Platform and 4 more
CVE-2026-93569

Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.

CVSS 3.1 · 8.2 High EPSS 2.4% KEV · Not listed
Vendors
Io.netty Redhat
Products
Netty-codec-http Amq Broker Apache Camel Quarkus and 20 more
CVE-2026-93568

Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Io.netty Redhat
Products
Netty-codec-http Amq Broker Apache Camel Quarkus and 21 more
CVE-2026-93567

Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Io.netty Redhat
Products
Netty-codec-http2 Amq Broker Apache Camel Quarkus and 21 more
CVE-2026-85634

Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name

A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Fuse Jbosseapxp and 1 more
CVE-2026-17615

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Quarkus Apicurio Registry Build Keycloak and 19 more
CVE-2026-15560

Openjdk-orb: unauthed class loading via iiop in eap

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Application Platform Els Jboss Enterprise Application Platform Expansion Pack and 1 more
CVE-2024-4029

Wildfly: no timeout for eap management interface may lead to denial of service (dos)

A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Jboss Bpms Jboss Data Grid and 4 more
CVE-2024-3653

Undertow: learningpushhandler can lead to remote memory dos attacks

A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.

CVSS 3.1 · 5.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Amq Streams Apache Camel Hawtio Build Keycloak and 14 more
CVE-2026-15562

Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss-remoting Jboss Enterprise Application Platform Jboss Enterprise Application Platform Els and 2 more
CVE-2026-91920

Undertow: undertow: chunkreader message length permits chunk-size overflow

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Camel Spring Boot Enterprise Linux Jboss Enterprise Application Platform and 3 more
CVE-2026-24330

Wildfly-core: wildfly: arbitrary file read via malicious archive deployment

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Fuse 7 Jboss Bpms Jboss Enterprise Application Platform and 7 more
CVE-2026-24329

Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file. Manual intervention is required to restore server operation, leading to a denial of service.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Fuse 7 Jboss Bpms Jboss Enterprise Application Platform and 6 more
CVE-2026-19879

Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Of Apache Camel For Spring Boot Camel Spring Boot Enterprise Linux and 6 more
CVE-2026-14180

Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.

CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Hawtio Build Of Apache Camel - Hawtio Build Of Apache Camel For Spring Boot and 11 more