widely-deployed-product-advisoryinternet-facing-service-vulnerabilityopen-source-dependency-vulnerability

Red Hat JBoss EAP 7.4.12 Fixes Undertow, Jackson and Jettison DoS Flaws

Patch & Detection Intelligence · 4 sources · Updated 2mo ago · First seen Aug 7, 2023

Red Hat released the Important advisory RHSA-2023:4505 for Red Hat JBoss Enterprise Application Platform (EAP) 7.4 on RHEL 7, upgrading installations from EAP 7.4.11 to 7.4.12. The release remediates three denial-of-service vulnerabilities affecting the Undertow web server, Jackson Databind, and Jettison components.

The maintenance update includes Undertow 2.2.25.SP3, an upgraded Jettison component, and a Jakarta Activation update. Organizations running EAP 7.4 on RHEL 7 x86_64 should back up EAP installations and deployed applications, then apply the updated EAP 7.4.12 packages to reduce service-availability risk.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Aug 7, 2023

Reported Jun 13, 20265mo ago
EAP 7.4.12 CVE fix linked to multipart form-data regression
Red Hat tracked an issue in which the CVE-2023-3223/UNDERTOW-2271 fix delivered with EAP 7.4.12 caused multipart form-data larger than 16 KiB to be unavailable through the Servlet getParameter API.
[JBEAP-26355] [GSS](7.4.z) UNDERTOW-2337 - Multipart form-data larger than 16KiB is not available through Servlet getParameter API after EAP 7.4.12 (CVE-2023-3223 / UNDERTOW-2271 fix) - Red Hat Issue Tracker
Aug 7, 20233y ago
Red Hat releases EAP 7.4.12 security update for RHEL 7
Red Hat issued Important advisory RHSA-2023:4505 for JBoss Enterprise Application Platform 7.4 on RHEL 7 x86_64. The update replaced EAP 7.4.11 with 7.4.12 and remediated denial-of-service vulnerabilities CVE-2023-3223 in Undertow, CVE-2021-46877 in Jackson Databind, and CVE-2023-1436 in Jettison.
RHSA-2023:4505 - Security Advisory - Red Hat Customer Portal

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

3 linked

Uncontrolled recursion in Jettison JSONArray (CVE-2023-1436)Jackson Databind JsonNode JDK Serialization Denial of Service (CVE-2021-46877)Undertow @MultipartConfig Multipart Memory Exhaustion (CVE-2023-3223)

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

UnclassifiedNews · Jun 13, 2026

[JBEAP-24835] (7.4.z) Upgrade Jakarta activation from 1.2.2.redhat-00001 to 1.2.2.redhat-00002 - Red Hat Issue TrackerOpen source ↗

UnclassifiedNews · Jun 13, 2026

[JBEAP-26355] [GSS](7.4.z) UNDERTOW-2337 - Multipart form-data larger than 16KiB is not available through Servlet getParameter API after EAP 7.4.12 (CVE-2023-3223 / UNDERTOW-2271 fix) - Red Hat Issue TrackerOpen source ↗

UnclassifiedNews · Jun 13, 2026

[JBEAP-24711] (7.4.z) Upgrade Jettison from 1.5.2.redhat-00002 to 1.5.4.redhat-x - Red Hat Issue TrackerOpen source ↗

UnclassifiedNews · Jun 13, 2026

[JBEAP-25204] [GSS](7.4.z) Upgrade Undertow from 2.2.25.SP2-redhat-00001 to 2.2.25.SP3 - Red Hat Issue TrackerOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Red Hat JBoss EAP 7.4.12 Fixes Undertow, Jackson and Jettison DoS Flaws

How this story unfolded

EAP 7.4.12 CVE fix linked to multipart form-data regression

Red Hat releases EAP 7.4.12 security update for RHEL 7

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Red Hat JBoss EAP 7.4.12 Fixes Three Denial-of-Service Vulnerabilities

Red Hat JBoss EAP 7 Updates Fix RBAC Escalation, Undertow Header Injection, and XXE

Red Hat JBoss EAP 7.4.6 Fixes Gson, HAL and Netty Vulnerabilities

Red Hat JBoss EAP 7.4.12 Fixes Undertow, Jackson and Jettison DoS Flaws

How this story unfolded

EAP 7.4.12 CVE fix linked to multipart form-data regression

Red Hat releases EAP 7.4.12 security update for RHEL 7

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Red Hat JBoss EAP 7.4.12 Fixes Three Denial-of-Service Vulnerabilities

Red Hat JBoss EAP 7 Updates Fix RBAC Escalation, Undertow Header Injection, and XXE

Red Hat JBoss EAP 7.4.6 Fixes Gson, HAL and Netty Vulnerabilities