Loading story…
Red Hat released JBoss Enterprise Application Platform (EAP) 7.4.12, replacing 7.4.11 and remediating denial-of-service flaws in Undertow, Jackson Databind, and Jettison: CVE-2023-3223, CVE-2021-46877, and CVE-2023-1436. The update is rated Important and also includes bug fixes, enhancements, and component updates affecting Undertow and Jettison.
Related EAP 7.4 maintenance work upgraded dependencies including WSS4J, JGroups Kubernetes discovery, PicketLink and PicketLink bindings, and the JBoss EJB client. Red Hat advises customers to back up existing EAP installations and deployed applications before applying the update.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2023:4509 for JBoss Enterprise Application Platform 7.4.12, replacing version 7.4.11. The release remediated denial-of-service flaws CVE-2023-3223, CVE-2021-46877, and CVE-2023-1436.
A Red Hat issue tracks upgrading jboss-ejb-client in JBoss EAP 7.4.z from 4.0.50.SP1-redhat-00001 to 4.0.53.Final-redhat-00001.
A Red Hat issue tracks upgrading PicketLink bindings in JBoss EAP 7.4.z from 2.5.5.SP12-redhat-00014 to 2.5.5.SP12-redhat-00016.
A Red Hat issue tracks upgrading PicketLink for JBoss EAP 7.4.z from 2.5.5.SP12-redhat-00012 to 2.5.5.SP12-redhat-00013.
A Red Hat issue tracks upgrading jgroups-kubernetes for JBoss EAP 7.4.z from 1.0.15.Final-redhat-00001 to 1.0.16.Final-redhat-00001.
A Red Hat issue tracks upgrading WSS4J in the JBoss EAP 7.4.z stream from 2.2.6.redhat-00001 to 2.2.7.redhat-00001.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
issues.redhat.com
Open sourceissues.redhat.com
Open sourceissues.redhat.com
Open sourceissues.redhat.com
Open sourceissues.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released the **Important** advisory `RHSA-2023:4505` for Red Hat JBoss Enterprise Application Platform (EAP) 7.4 on RHEL 7, upgrading installations from EAP 7.4.11 to 7.4.12. The release remediates three denial-of-service vulnerabilities affecting the Undertow web server, Jackson Databind, and Jettison components. The maintenance update includes Undertow `2.2.25.SP3`, an upgraded Jettison component, and a Jakarta Activation update. Organizations running EAP 7.4 on RHEL 7 x86_64 should back up EAP installations and deployed applications, then apply the updated EAP 7.4.12 packages to reduce service-availability risk.
Aug 28, 2026
Red Hat released JBoss Enterprise Application Platform (EAP) 7.0.2 updates for RHEL 6, RHEL 7, and the `eap7-jboss-ec2-eap` package to remediate three security flaws: **CVE-2016-5406**, a domain-management RBAC propagation failure that can grant full administrative privileges on EAP 6.2–6.4 slave hosts; **CVE-2016-4993**, Undertow HTTP header injection and response splitting through unsanitized header input; and **CVE-2015-0254**, an XXE flaw in JSTL that can expose host resources and may enable arbitrary code execution. The fixes were delivered in RHSA-2016:1838 for RHEL 6, RHSA-2016:1839 for RHEL 7, and RHSA-2016:1840 for EAP EC2 deployments. Affected organizations should back up EAP installations and deployed applications, apply the appropriate EAP 7.0.2 packages, and restart JBoss server processes to activate the remediations.
Aug 28, 2026
Red Hat released **JBoss Enterprise Application Platform (EAP) 7.4.6**, replacing EAP 7.4.5, to remediate three moderate-severity vulnerabilities in bundled components. The update fixes `CVE-2022-25647`, Gson deserialization of untrusted data; `CVE-2021-44906`, prototype pollution in the `minimist` dependency used by JBoss HAL; and `CVE-2022-24823`, a Netty issue in which world-readable temporary files could expose sensitive information. The advisory applies to EAP 7.4 deployments, including those on Red Hat Enterprise Linux 8. Organizations running JBoss EAP 7.4 should install previously released relevant errata and upgrade to EAP 7.4.6. The release follows EAP 7.4.5, which had addressed 15 security issues across components including H2, Netty, Jackson Databind, OpenJDK, Undertow, WildFly, and ActiveMQ Artemis; Red Hat also tracked subsequent maintenance upgrades for Jackson Databind and Artemis in the 7.4.z stream.
Aug 28, 2026