CVE record · CVE-2025-12799

Jastow: jastow cross-site scripting attack due to unsanitized uri

CVSS 6.5 MediumEPSS 0.0041 · 35th percentile

Published by the CVE Program (CNA: redhat) at 7 Jul 2026, 16:18 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1.7.GA Package name: io.undertow.jastow/jastow https://access.redhat.com/downloads/content/package-browser/	unaffected 2.2.9.SP1-redhat-00001 to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8 https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1-9.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-activemq-artemis https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.40.0-7.redhat_00015.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-activemq-artemis-native https://access.redhat.com/downloads/content/package-browser/	unaffected 1:2.0.0-2.redhat_00005.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-aesh-extensions https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.8.0-2.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-aesh-readline https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.4.0-1.redhat_00002.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-agroal https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.3.0-1.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-angus https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.0.5-1.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-angus-activation https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.0.3-1.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-antlr4 https://access.redhat.com/downloads/content/package-browser/	unaffected 0:4.13.2-1.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-apache-commons-beanutils https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.11.0-1.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-apache-commons-cli https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.9.0-1.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-apache-commons-codec https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.17.2-1.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-apache-commons-collections https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.2.2-28.redhat_2.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-apache-commons-io https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.16.1-2.redhat_00002.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-apache-commons-lang https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.18.0-2.redhat_00003.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-apache-cxf https://access.redhat.com/downloads/content/package-browser/	unaffected 0:4.0.10-3.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-apache-cxf-xjc-utils https://access.redhat.com/downloads/content/package-browser/	unaffected 0:4.1.0-1.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-apache-mime4j https://access.redhat.com/downloads/content/package-browser/	unaffected 0:0.8.12-1.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-apache-sshd https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.14.0-4.redhat_00003.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-artemis-native https://access.redhat.com/downloads/content/package-browser/	unaffected 1:2.0.0-2.redhat_00005.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-artemis-wildfly-integration https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.0.4-1.Final_redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-asyncutil https://access.redhat.com/downloads/content/package-browser/	unaffected 0:0.1.0-2.redhat_00010.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-atinject https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.0.1-5.redhat_00007.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-aws-java-sdk https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.30.32-3.redhat_00003.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-azure-storage https://access.redhat.com/downloads/content/package-browser/	unaffected 0:8.6.6-5.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-bouncycastle https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.84.0-1.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-byte-buddy https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.14.18-2.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-caffeine https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.1.8-2.redhat_00002.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-commons-logging-jboss-logging https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.0.0-2.Final_redhat_1.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-cryptacular https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.2.5-2.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-eap-product-conf-parent https://access.redhat.com/downloads/content/package-browser/	unaffected 0:801.7.0-1.GA_redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-ecj https://access.redhat.com/downloads/content/package-browser/	unaffected 1:3.33.0-1.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-eclipse-jgit https://access.redhat.com/downloads/content/package-browser/	unaffected 0:6.10.1.202505221210-1.r_redhat_00002.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-elasticsearch https://access.redhat.com/downloads/content/package-browser/	unaffected 0:8.15.4-4.redhat_00003.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-elytron-web https://access.redhat.com/downloads/content/package-browser/	unaffected 0:4.1.2-1.Final_redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-eventstream https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.0.1-3.redhat_00003.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-expressly https://access.redhat.com/downloads/content/package-browser/	unaffected 0:5.0.0-6.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-fastinfoset https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.1.1-1.redhat_00001.1.el10eap to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 Package name: eap8-fge-btf https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.2.0-4.redhat_00007.1.el10eap to before * rpm Other versions: affected

And 200 more products. The full list is on the CVE record.

Identifiers: CVE-2025-12799
CNA: redhat
Weakness (CWE): CWE-79
Tags: Red Hat JBoss Enterprise Application Platform 8.1.7.GA
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
Red Hat JBoss Enterprise Application Platform 7
Red Hat JBoss Enterprise Application Platform 8
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat Single Sign-On 7
Cross-site scripting (XSS)
Published: 7 Jul 2026
Updated: 29 Jul 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
6.5	Medium	3.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N	CNA (redhat)

CISA KEV Not listed.
EPSS 0.0041, the 35th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 7 Jul 2026. New records show when each source confirmed them.

Sources

References from the CNA

access.redhat.com/errata/RHSA-2026:36342 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:36343 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:36344 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:36345 vendor-advisoryredhat
access.redhat.com/security/cve/CVE-2025-12799 vdb-entryredhat
bugzilla.redhat.com/show_bug.cgi?id=2413071 issue-trackingredhat

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.