Red Hat JBoss EAP 8.1.6 Fixes Multiple High-Impact Bundled Component Flaws
Patch & Detection Intelligence · 7 sources · Updated 2mo ago · First seen May 18, 2026
Red Hat released JBoss Enterprise Application Platform 8.1.6 as an Important security update for RHEL 8 and RHEL 9, replacing version 8.1.5 and addressing a broad set of vulnerabilities in bundled components including Bouncy Castle, Netty, Apache ActiveMQ Artemis, c3p0, mchange-commons-java, minimatch, WildFly Elytron, and plexus-utils. The advisories cite risks including denial of service, request smuggling, LDAP injection, directory traversal, brute-force exposure, message injection and exfiltration, arbitrary code execution, private key leakage, and cryptographic implementation flaws.
One of the tracked issues, CVE-2026-27904, affects the JavaScript glob-matching library minimatch and can cause denial of service through catastrophic backtracking in nested extglob expressions. Red Hat said the flaw was fixed across multiple products and included in the JBoss EAP updates, alongside other bundled-component remediations delivered through advisories RHSA-2026:18054, RHSA-2026:18055, and RHSA-2026:18059. Customers were advised to apply prior relevant errata, back up installations and data, and then upgrade to the fixed packages.
