Loading story…
Red Hat released JBoss Enterprise Application Platform 8.1.7 with an Important security update to remediate five vulnerabilities in bundled Netty components affecting JBoss EAP 8.1 deployments. The flaws can enable denial of service, information disclosure and data manipulation, hostname verification bypass, insufficient bailiwick validation for NS records, and an IPv6 subnet rule bypass, impacting JBoss EAP 8.1 on RHEL 8, RHEL 9, and RHEL 10 for x86_64 systems.
The fixes were published in Red Hat advisories RHSA-2026:49700 and RHSA-2026:49701, which update Netty in the JBoss EAP 8.1.z stream from 4.1.133.Final-redhat-00001 to 4.1.135.Final-redhat-00001. Red Hat’s product documentation and release materials for JBoss EAP 8.1 accompany the release, while the advisories direct customers to ensure prerequisite errata are applied, back up existing installations, and deploy the updated packages.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
As part of the 2026-08-03 security update, Red Hat upgraded Netty in JBoss EAP 8.1.z from 4.1.133.Final-redhat-00001 to 4.1.135.Final-redhat-00001. The advisories list updated Netty and WildFly packages for the affected JBoss EAP 8.1.7 builds.
The 2026-08-03 advisories state that Red Hat fixed five Netty vulnerabilities in JBoss EAP 8.1.7: CVE-2026-45416, CVE-2026-45674, CVE-2026-50010, CVE-2026-47691, and CVE-2026-44249. The issues covered denial of service, information disclosure and data manipulation, hostname verification bypass, insufficient bailiwick validation, and an IPv6 subnet rule bypass.
On 2026-08-03, Red Hat issued Important security advisories RHSA-2026:49700 and RHSA-2026:49701 for Red Hat JBoss Enterprise Application Platform 8.1.7. The advisories announced security updates for JBoss EAP 8.1 affecting supported x86_64 builds, including RHEL 8, RHEL 9, and RHEL 10 variants.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcedocs.redhat.com
Open sourcedocs.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **JBoss Enterprise Application Platform 8.1.6** as an **Important** security update for **RHEL 8** and **RHEL 9**, replacing version 8.1.5 and addressing a broad set of vulnerabilities in bundled components including **Bouncy Castle**, **Netty**, **Apache ActiveMQ Artemis**, **c3p0**, **mchange-commons-java**, **minimatch**, **WildFly Elytron**, and **plexus-utils**. The advisories cite risks including denial of service, request smuggling, LDAP injection, directory traversal, brute-force exposure, message injection and exfiltration, arbitrary code execution, private key leakage, and cryptographic implementation flaws. One of the tracked issues, **`CVE-2026-27904`**, affects the JavaScript glob-matching library **minimatch** and can cause denial of service through catastrophic backtracking in nested extglob expressions. Red Hat said the flaw was fixed across multiple products and included in the JBoss EAP updates, alongside other bundled-component remediations delivered through advisories **`RHSA-2026:18054`**, **`RHSA-2026:18055`**, and **`RHSA-2026:18059`**. Customers were advised to apply prior relevant errata, back up installations and data, and then upgrade to the fixed packages.
Aug 20, 2026
Red Hat released **JBoss Enterprise Application Platform (EAP) 7.4.6**, replacing EAP 7.4.5, to remediate three moderate-severity vulnerabilities in bundled components. The update fixes `CVE-2022-25647`, Gson deserialization of untrusted data; `CVE-2021-44906`, prototype pollution in the `minimist` dependency used by JBoss HAL; and `CVE-2022-24823`, a Netty issue in which world-readable temporary files could expose sensitive information. The advisory applies to EAP 7.4 deployments, including those on Red Hat Enterprise Linux 8. Organizations running JBoss EAP 7.4 should install previously released relevant errata and upgrade to EAP 7.4.6. The release follows EAP 7.4.5, which had addressed 15 security issues across components including H2, Netty, Jackson Databind, OpenJDK, Undertow, WildFly, and ActiveMQ Artemis; Red Hat also tracked subsequent maintenance upgrades for Jackson Databind and Artemis in the 7.4.z stream.
Aug 28, 2026
Red Hat released **JBoss Enterprise Application Platform (EAP) 7.4.12**, replacing 7.4.11 and remediating denial-of-service flaws in Undertow, Jackson Databind, and Jettison: `CVE-2023-3223`, `CVE-2021-46877`, and `CVE-2023-1436`. The update is rated **Important** and also includes bug fixes, enhancements, and component updates affecting Undertow and Jettison. Related EAP 7.4 maintenance work upgraded dependencies including WSS4J, JGroups Kubernetes discovery, PicketLink and PicketLink bindings, and the JBoss EJB client. Red Hat advises customers to back up existing EAP installations and deployed applications before applying the update.
Aug 27, 2026