Loading story…
Red Hat released the Important advisory RHSA-2023:4505 for Red Hat JBoss Enterprise Application Platform (EAP) 7.4 on RHEL 7, upgrading installations from EAP 7.4.11 to 7.4.12. The release remediates three denial-of-service vulnerabilities affecting the Undertow web server, Jackson Databind, and Jettison components.
The maintenance update includes Undertow 2.2.25.SP3, an upgraded Jettison component, and a Jakarta Activation update. Organizations running EAP 7.4 on RHEL 7 x86_64 should back up EAP installations and deployed applications, then apply the updated EAP 7.4.12 packages to reduce service-availability risk.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2023:4505 for JBoss Enterprise Application Platform 7.4 on RHEL 7 x86_64. The update replaced EAP 7.4.11 with 7.4.12 and remediated denial-of-service vulnerabilities CVE-2023-3223 in Undertow, CVE-2021-46877 in Jackson Databind, and CVE-2023-1436 in Jettison.
Red Hat tracked an issue in which the CVE-2023-3223/UNDERTOW-2271 fix delivered with EAP 7.4.12 caused multipart form-data larger than 16 KiB to be unavailable through the Servlet getParameter API.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
issues.redhat.com
Open sourceissues.redhat.com
Open sourceissues.redhat.com
Open sourceissues.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **JBoss Enterprise Application Platform (EAP) 7.4.12**, replacing 7.4.11 and remediating denial-of-service flaws in Undertow, Jackson Databind, and Jettison: `CVE-2023-3223`, `CVE-2021-46877`, and `CVE-2023-1436`. The update is rated **Important** and also includes bug fixes, enhancements, and component updates affecting Undertow and Jettison. Related EAP 7.4 maintenance work upgraded dependencies including WSS4J, JGroups Kubernetes discovery, PicketLink and PicketLink bindings, and the JBoss EJB client. Red Hat advises customers to back up existing EAP installations and deployed applications before applying the update.
Aug 27, 2026
Red Hat released JBoss Enterprise Application Platform (EAP) 7.0.2 updates for RHEL 6, RHEL 7, and the `eap7-jboss-ec2-eap` package to remediate three security flaws: **CVE-2016-5406**, a domain-management RBAC propagation failure that can grant full administrative privileges on EAP 6.2–6.4 slave hosts; **CVE-2016-4993**, Undertow HTTP header injection and response splitting through unsanitized header input; and **CVE-2015-0254**, an XXE flaw in JSTL that can expose host resources and may enable arbitrary code execution. The fixes were delivered in RHSA-2016:1838 for RHEL 6, RHSA-2016:1839 for RHEL 7, and RHSA-2016:1840 for EAP EC2 deployments. Affected organizations should back up EAP installations and deployed applications, apply the appropriate EAP 7.0.2 packages, and restart JBoss server processes to activate the remediations.
Aug 28, 2026
Red Hat released **JBoss Enterprise Application Platform (EAP) 7.4.6**, replacing EAP 7.4.5, to remediate three moderate-severity vulnerabilities in bundled components. The update fixes `CVE-2022-25647`, Gson deserialization of untrusted data; `CVE-2021-44906`, prototype pollution in the `minimist` dependency used by JBoss HAL; and `CVE-2022-24823`, a Netty issue in which world-readable temporary files could expose sensitive information. The advisory applies to EAP 7.4 deployments, including those on Red Hat Enterprise Linux 8. Organizations running JBoss EAP 7.4 should install previously released relevant errata and upgrade to EAP 7.4.6. The release follows EAP 7.4.5, which had addressed 15 security issues across components including H2, Netty, Jackson Databind, OpenJDK, Undertow, WildFly, and ActiveMQ Artemis; Red Hat also tracked subsequent maintenance upgrades for Jackson Databind and Artemis in the 7.4.z stream.
Aug 28, 2026