Loading story…
Red Hat fixed CVE-2016-9589, a CVSS 7.5 denial-of-service vulnerability in the HTTP Header Cache of JBoss Enterprise Application Platform (EAP) 7 and related Undertow/WildFly components. An unauthenticated remote attacker could send garbage headers over persistent TCP connections, causing cached header values to consume heap memory until service availability is disrupted. Memory use could grow with each active connection, up to the configured header-count and header-size limits; cited defaults allowed 200 headers of up to 1 MB each per connection.
The flaw, tracked upstream as WFLY-7725 and classified as CWE-400 uncontrolled resource consumption, was remediated in JBoss EAP 7.0.5 through Red Hat advisories RHSA-2017:0830, RHSA-2017:0831, RHSA-2017:0834, and RHSA-2017:3456, including EAP deployments on RHEL 6 and RHEL 7 and affected Red Hat Single Sign-On releases. Organizations should apply the applicable EAP updates after backing up existing installations and deployed applications; the same update stream also addressed the local privilege-escalation issue CVE-2016-8656 in certain EAP packages.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2017:0832, updating JBoss EAP 7.0 on RHEL 7 from 7.0.4 to 7.0.5. The advisory fixed CVE-2016-9589 and CVE-2016-8656, a local privilege-escalation flaw involving unsafe ownership handling of server.log by the JBoss init script.
Red Hat issued RHSA-2017:0834 for the eap7-jboss-ec2-eap package on RHEL 6 and 7, updating it to version 7.0.5 and addressing the Header Cache denial-of-service vulnerability.
Red Hat issued RHSA-2017:0830 and RHSA-2017:0831 to fix CVE-2016-9589 in JBoss EAP 7, including an update of JBoss EAP 7.0 on RHEL 6 from version 7.0.4 to 7.0.5.
Red Hat released RHSA-2017:3456 to fix CVE-2016-9589 in JBoss EAP 7. Related advisories RHSA-2017:3454, RHSA-2017:3455, and RHSA-2017:3458 also addressed the issue for JBoss EAP products on RHEL 6 and RHEL 7.
Gabriel Lavoie of Halogen Software reported the inefficient Header Cache issue in JBoss EAP 7, which could allow an unauthenticated remote attacker to exhaust heap memory and cause denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
rhn.redhat.com
Open sourcerhn.redhat.com
Open sourcerhn.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released an important-security update for **JBoss Enterprise Application Platform (EAP) 5.1.2**, addressing multiple flaws in its JBoss Web component. The fixes mitigate remote denial-of-service attacks triggered by malformed UTF-8 surrogate pairs, hash-collision parameter names, and excessive request parameters or values; the update also introduces default limits of 512 parameters and 128 headers per request to reduce resource exhaustion risk. The update corrects HTTP Digest authentication weaknesses, including **CVE-2011-5062**, in which improper validation of `qop` values could let remote attackers select `qop=auth` and bypass intended integrity protections. It also fixes a `sendfile` issue through which a malicious deployed web application could evade Security Manager restrictions, read unauthorized files, or potentially terminate the JVM. Red Hat advised EAP 5.1.2 users to back up customized configurations and install the update.
Aug 29, 2026
Red Hat released JBoss Enterprise Application Platform (EAP) 7.0.2 updates for RHEL 6, RHEL 7, and the `eap7-jboss-ec2-eap` package to remediate three security flaws: **CVE-2016-5406**, a domain-management RBAC propagation failure that can grant full administrative privileges on EAP 6.2–6.4 slave hosts; **CVE-2016-4993**, Undertow HTTP header injection and response splitting through unsanitized header input; and **CVE-2015-0254**, an XXE flaw in JSTL that can expose host resources and may enable arbitrary code execution. The fixes were delivered in RHSA-2016:1838 for RHEL 6, RHSA-2016:1839 for RHEL 7, and RHSA-2016:1840 for EAP EC2 deployments. Affected organizations should back up EAP installations and deployed applications, apply the appropriate EAP 7.0.2 packages, and restart JBoss server processes to activate the remediations.
Aug 28, 2026
Red Hat released **JBoss Enterprise Application Platform (EAP) 6.4.14** to replace 6.4.13 and remediate three security flaws across EAP 6 packages for supported RHEL 5, 6, and 7 deployments, including `jboss-ec2-eap`. **CVE-2016-8657** allowed local members of the `jboss` group to modify the group-writable `/etc/sysconfig/jbossas` file; on RHEL 6 and earlier systems using legacy `/etc/init.d` service scripts, that file was sourced with root privileges during JBoss service operations, enabling local privilege escalation. The release also fixes **CVE-2017-6056**, an Apache Tomcat HTTPS request-processing flaw that could trigger an infinite loop and denial of service, and **CVE-2016-6346**, where RESTEasy's `GZIPInterceptor` could be unnecessarily enabled and permit denial of service. Red Hat advised customers to back up EAP installations and deployed applications before updating. The vendor clarified that the initial ZIP-distribution advisory did not resolve CVE-2016-8657, because the affected writable configuration file was present in RPM-based installations.
Aug 28, 2026