Loading story…
Red Hat released JBoss Enterprise Application Platform (EAP) 7.4.6, replacing EAP 7.4.5, to remediate three moderate-severity vulnerabilities in bundled components. The update fixes CVE-2022-25647, Gson deserialization of untrusted data; CVE-2021-44906, prototype pollution in the minimist dependency used by JBoss HAL; and CVE-2022-24823, a Netty issue in which world-readable temporary files could expose sensitive information. The advisory applies to EAP 7.4 deployments, including those on Red Hat Enterprise Linux 8.
Organizations running JBoss EAP 7.4 should install previously released relevant errata and upgrade to EAP 7.4.6. The release follows EAP 7.4.5, which had addressed 15 security issues across components including H2, Netty, Jackson Databind, OpenJDK, Undertow, WildFly, and ActiveMQ Artemis; Red Hat also tracked subsequent maintenance upgrades for Jackson Databind and Artemis in the 7.4.z stream.
See real exploitation activity before you spend the cycle.
16 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2023:4507 for JBoss EAP 7.4 on RHEL 9, updating EAP from version 7.4.11 to 7.4.12. The update remediated Undertow OutOfMemoryError flaw CVE-2023-3223, Jackson Databind denial-of-service flaw CVE-2021-46877, and Jettison uncontrolled-recursion flaw CVE-2023-1436.
Red Hat issued Important advisory RHSA-2023:4506 for JBoss EAP 7.4 on RHEL 8, updating EAP from 7.4.11 to 7.4.12. The update remediated Undertow OutOfMemoryError flaw CVE-2023-3223, Jackson Databind denial-of-service flaw CVE-2021-46877, and Jettison uncontrolled-recursion flaw CVE-2023-1436.
Red Hat published Moderate-severity advisory RHSA-2022:5928, delivering JBoss EAP 7.4.6 to replace 7.4.5. The update addressed the Gson, minimist, and Netty vulnerabilities tracked as CVE-2022-25647, CVE-2021-44906, and CVE-2022-24823.
Red Hat issued Moderate-impact advisory RHSA-2022:5893 for JBoss EAP 7.4 on Red Hat Enterprise Linux 8, updating EAP from 7.4.5 to 7.4.6. It fixed Gson deserialization (CVE-2022-25647), minimist prototype pollution (CVE-2021-44906), and Netty world-readable temporary-file exposure (CVE-2022-24823).
Red Hat issued Moderate-severity advisory RHSA-2022:5029 for the Red Hat build of Eclipse Vert.x 4.2.7 GA on OpenShift Application Runtimes for x86_64. The update addressed jackson-databind denial of service vulnerability CVE-2020-36518 and Gson unsafe deserialization vulnerability CVE-2022-25647.
Red Hat issued Moderate-impact advisory RHSA-2022:4922 for JBoss EAP 7.4, replacing version 7.4.4 with 7.4.5. The update remediated 15 issues, including H2 remote code execution and remote JNDI class loading flaws, Netty issues, XML denial-of-service flaws, an ActiveMQ Artemis denial of service, and a Moment.js path-traversal vulnerability.
Red Hat began issuing advisories for CVE-2020-36518, a jackson-databind denial-of-service flaw in which deeply nested objects can cause a Java StackOverflow exception. The rollout included Red Hat Data Grid 8.3.1 through RHSA-2022:2232 and subsequently affected numerous other Red Hat product lines.
Red Hat issued Low-severity advisory RHSA-2022:1299, updating JBoss EAP from 7.4.3 to 7.4.4. The release upgraded Log4j to 2.17.1.redhat-00001 and remediated seven Log4j and Log4j Core flaws, including remote-code-execution, denial-of-service, SQL-injection, and unsafe-deserialization issues.
Red Hat issued Moderate advisory RHSA-2021:4679 for JBoss EAP 7.4, updating version 7.4.1 to 7.4.2. The update remediated six flaws, including Undertow HTTP/2 denial of service, WildFly local-user access, Apache MINA SSHD memory-leak denial of service, RESTEasy endpoint disclosure, and xml-security information disclosure issues.
Red Hat issued Important advisory RHSA-2021:3660 for JBoss EAP 7.4, updating it from version 7.4.0 to 7.4.1. The release remediated nine flaws including Velocity arbitrary code execution, Undertow denial-of-service issues, Netty request smuggling, Jakarta EL expression evaluation, Apache Commons IO path traversal, and WildFly XSS.
CVE-2021-21290 was published as a medium-severity local information-disclosure vulnerability affecting Netty versions before 4.1.59.Final on Unix-like systems. Netty fixed the issue in 4.1.59.Final; affected disk-based multipart upload handling could create world-readable temporary files containing sensitive data.
Red Hat Issue Tracker item JBEAP-24790 documents an upgrade of HAL in the JBoss EAP 7.4.z stream from version 3.3.17.Final-redhat-00001 to 3.3.18.Final-redhat-00001.
Red Hat Issue Tracker item JBEAP-22864 documents an upgrade of HAL in the JBoss EAP 7.4.z stream from version 3.3.8.Final-redhat-00001 to 3.3.9.Final-redhat-00001.
Red Hat Issue Tracker item JBEAP-22462 documents an upgrade of HAL in the JBoss EAP 7.4.z stream from version 3.3.7.Final-redhat-00001 to 3.3.8.Final-redhat-00001.
Red Hat Issue Tracker item JBEAP-22160 documents an upgrade of jakarta.el in the JBoss EAP 7.4.z stream from version 3.0.3.redhat-00002 to 3.0.3.redhat-00006.
Red Hat addressed CVE-2022-25647, a Gson deserialization denial-of-service vulnerability, in JBoss EAP 7.1 EUS and 7.3 EUS for RHEL 7 through RHSA-2025:4226 and RHSA-2025:4437, respectively.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
20 references tracked. Mallory keeps watching after this page renders.
issues.redhat.com
Open sourceissues.redhat.com
Open sourceissues.redhat.com
Open sourceissues.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **JBoss Enterprise Application Platform (EAP) 7.4.12**, replacing 7.4.11 and remediating denial-of-service flaws in Undertow, Jackson Databind, and Jettison: `CVE-2023-3223`, `CVE-2021-46877`, and `CVE-2023-1436`. The update is rated **Important** and also includes bug fixes, enhancements, and component updates affecting Undertow and Jettison. Related EAP 7.4 maintenance work upgraded dependencies including WSS4J, JGroups Kubernetes discovery, PicketLink and PicketLink bindings, and the JBoss EJB client. Red Hat advises customers to back up existing EAP installations and deployed applications before applying the update.
Aug 27, 2026
Red Hat released the **Important** advisory `RHSA-2023:4505` for Red Hat JBoss Enterprise Application Platform (EAP) 7.4 on RHEL 7, upgrading installations from EAP 7.4.11 to 7.4.12. The release remediates three denial-of-service vulnerabilities affecting the Undertow web server, Jackson Databind, and Jettison components. The maintenance update includes Undertow `2.2.25.SP3`, an upgraded Jettison component, and a Jakarta Activation update. Organizations running EAP 7.4 on RHEL 7 x86_64 should back up EAP installations and deployed applications, then apply the updated EAP 7.4.12 packages to reduce service-availability risk.
Aug 28, 2026
Red Hat released JBoss Enterprise Application Platform (EAP) 7.0.2 updates for RHEL 6, RHEL 7, and the `eap7-jboss-ec2-eap` package to remediate three security flaws: **CVE-2016-5406**, a domain-management RBAC propagation failure that can grant full administrative privileges on EAP 6.2–6.4 slave hosts; **CVE-2016-4993**, Undertow HTTP header injection and response splitting through unsanitized header input; and **CVE-2015-0254**, an XXE flaw in JSTL that can expose host resources and may enable arbitrary code execution. The fixes were delivered in RHSA-2016:1838 for RHEL 6, RHSA-2016:1839 for RHEL 7, and RHSA-2016:1840 for EAP EC2 deployments. Affected organizations should back up EAP installations and deployed applications, apply the appropriate EAP 7.0.2 packages, and restart JBoss server processes to activate the remediations.
Aug 28, 2026