Loading story…
Red Hat released JBoss Enterprise Application Platform 8.1.6 as an Important security update for RHEL 8 and RHEL 9, replacing version 8.1.5 and addressing a broad set of vulnerabilities in bundled components including Bouncy Castle, Netty, Apache ActiveMQ Artemis, c3p0, mchange-commons-java, minimatch, WildFly Elytron, and plexus-utils. The advisories cite risks including denial of service, request smuggling, LDAP injection, directory traversal, brute-force exposure, message injection and exfiltration, arbitrary code execution, private key leakage, and cryptographic implementation flaws.
One of the tracked issues, CVE-2026-27904, affects the JavaScript glob-matching library minimatch and can cause denial of service through catastrophic backtracking in nested extglob expressions. Red Hat said the flaw was fixed across multiple products and included in the JBoss EAP updates, alongside other bundled-component remediations delivered through advisories RHSA-2026:18054, RHSA-2026:18055, and RHSA-2026:18059. Customers were advised to apply prior relevant errata, back up installations and data, and then upgrade to the fixed packages.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-18, Red Hat published RHSA-2026:18054, RHSA-2026:18055, and RHSA-2026:18059, releasing JBoss Enterprise Application Platform 8.1.6 as an Important security update replacing 8.1.5 for supported RHEL 8 and RHEL 9 deployments. The update includes fixes for multiple bundled-component vulnerabilities across Bouncy Castle, Netty, Apache ActiveMQ Artemis, c3p0, mchange-commons-java, minimatch, WildFly Elytron, and plexus-utils.
Red Hat Bugzilla documented CVE-2026-27904 as a denial-of-service flaw in minimatch caused by catastrophic backtracking in nested extglob-derived regular expressions. The entry states fixed upstream versions and notes the issue can be triggered through the default minimatch() API.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
redhat.atlassian.net
Open sourceredhat.atlassian.net
Open sourceredhat.atlassian.net
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **JBoss Enterprise Application Platform 8.1.7** with an **Important** security update to remediate five vulnerabilities in bundled **Netty** components affecting JBoss EAP 8.1 deployments. The flaws can enable **denial of service**, **information disclosure and data manipulation**, **hostname verification bypass**, **insufficient bailiwick validation for NS records**, and an **IPv6 subnet rule bypass**, impacting JBoss EAP 8.1 on **RHEL 8, RHEL 9, and RHEL 10** for `x86_64` systems. The fixes were published in Red Hat advisories `RHSA-2026:49700` and `RHSA-2026:49701`, which update Netty in the JBoss EAP 8.1.z stream from `4.1.133.Final-redhat-00001` to `4.1.135.Final-redhat-00001`. Red Hat’s product documentation and release materials for JBoss EAP 8.1 accompany the release, while the advisories direct customers to ensure prerequisite errata are applied, back up existing installations, and deploy the updated packages.
Aug 20, 2026
Red Hat released **JBoss Enterprise Application Platform (EAP) 7.4.12**, replacing 7.4.11 and remediating denial-of-service flaws in Undertow, Jackson Databind, and Jettison: `CVE-2023-3223`, `CVE-2021-46877`, and `CVE-2023-1436`. The update is rated **Important** and also includes bug fixes, enhancements, and component updates affecting Undertow and Jettison. Related EAP 7.4 maintenance work upgraded dependencies including WSS4J, JGroups Kubernetes discovery, PicketLink and PicketLink bindings, and the JBoss EJB client. Red Hat advises customers to back up existing EAP installations and deployed applications before applying the update.
Aug 27, 2026
Red Hat released **JBoss Enterprise Application Platform (EAP) 6.4.14** to replace 6.4.13 and remediate three security flaws across EAP 6 packages for supported RHEL 5, 6, and 7 deployments, including `jboss-ec2-eap`. **CVE-2016-8657** allowed local members of the `jboss` group to modify the group-writable `/etc/sysconfig/jbossas` file; on RHEL 6 and earlier systems using legacy `/etc/init.d` service scripts, that file was sourced with root privileges during JBoss service operations, enabling local privilege escalation. The release also fixes **CVE-2017-6056**, an Apache Tomcat HTTPS request-processing flaw that could trigger an infinite loop and denial of service, and **CVE-2016-6346**, where RESTEasy's `GZIPInterceptor` could be unnecessarily enabled and permit denial of service. Red Hat advised customers to back up EAP installations and deployed applications before updating. The vendor clarified that the initial ZIP-distribution advisory did not resolve CVE-2016-8657, because the affected writable configuration file was present in RPM-based installations.
Aug 28, 2026