Advisories · Technology
Red Hat JBoss Enterprise Application Platform 8.1.
Every CVE that names Red Hat JBoss Enterprise Application Platform 8.1 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)
- Red Hat Build of Debezium 3.6
- Red Hat build of Quarkus 3.27.5.SP2
- CWE-1035
- CVSS 7.5 High
Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests
- Red Hat Build of Apache Camel 3.33.3.SP2
- Red Hat Build of Debezium 3.6
- CWE-20
- CVSS 8.2 High
Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority
- Red Hat Build of Apache Camel 3.33.3.SP2
- Red Hat Build of Debezium 3.6
- HTTP request smuggling
- CVSS 7.5 High
Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority
- Red Hat Build of Apache Camel 3.33.3.SP2
- Red Hat Build of Debezium 3.6
- CWE-20
- CVSS 5.3 Medium
Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size
- Red Hat Build of Debezium 3.6
- Red Hat build of Quarkus 3.27.5.SP2
- CWE-1035
- CVSS 7.4 High
Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config
- Red Hat
- Red Hat Build of Apache Camel 3.33.4.redhat
- CWE-346
- CWE-942
- CVSS 7.5 High
Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)
- Red Hat
- Red Hat Build of Apache Camel 3.33.4.redhat
- CWE-409
- CVSS 7.5 High
Resteasy-core: resteasy sourceprovider remote unauthenticated file read
- Red Hat Build of Apache Camel 3.33.3.SP1
- Red Hat build of Keycloak 26.6
- XML external entities (XXE)