Loading story…
Red Hat released an important-security update for JBoss Enterprise Application Platform (EAP) 5.1.2, addressing multiple flaws in its JBoss Web component. The fixes mitigate remote denial-of-service attacks triggered by malformed UTF-8 surrogate pairs, hash-collision parameter names, and excessive request parameters or values; the update also introduces default limits of 512 parameters and 128 headers per request to reduce resource exhaustion risk.
The update corrects HTTP Digest authentication weaknesses, including CVE-2011-5062, in which improper validation of qop values could let remote attackers select qop=auth and bypass intended integrity protections. It also fixes a sendfile issue through which a malicious deployed web application could evade Security Manager restrictions, read unauthorized files, or potentially terminate the JVM. Red Hat advised EAP 5.1.2 users to back up customized configurations and install the update.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-rated RHSA-2013:0623 for Red Hat Enterprise Linux 6, providing updated Tomcat 6 packages that fix FORM-authentication authorization bypass, NIO/HTTPS sendfile denial of service, and DIGEST-authentication weaknesses that could enable replay attacks. Administrators were instructed to install the updated packages and restart Tomcat.
CVE-2011-5062 was published, documenting that affected Apache Tomcat HTTP Digest Access Authentication implementations did not validate qop values, allowing a remote attacker using qop=auth to bypass intended integrity protection.
Red Hat released an important-security-impact update for JBoss Enterprise Application Platform 5.1.2, fixing multiple JBoss Web vulnerabilities including denial-of-service, HTTP DIGEST authentication, and sendfile issues. The update introduced default limits of 512 request parameters and 128 headers, and Red Hat advised affected users to back up customized configurations and install it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
rhn.redhat.com
Open sourcecve.mitre.org
Open sourcerhn.redhat.com
Open sourcerhn.redhat.com
Open sourcerhn.redhat.com
Open sourcelists.opensuse.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat issued Moderate-security updates for JBoss Enterprise Application Platform (EAP) 6.2.2, JBoss Web Server 2.0.1, and RHEL `tomcat6` packages to address **CVE-2013-4286**, an HTTP request-processing flaw involving conflicting `Content-Length` and chunked-transfer headers. Successful exploitation could cause web-cache poisoning, cross-site scripting, or disclosure of data from other requests. The related Tomcat updates also remediate **CVE-2013-4322**, a resource-exhaustion denial of service in chunked-request processing, and **CVE-2014-0050**, an infinite-loop denial of service in embedded Apache Commons FileUpload; Tomcat 6 updates additionally address **CVE-2014-0033**, a URL-rewriting issue that could facilitate session hijacking. Red Hat instructed affected EAP, JBoss Web Server, and Tomcat administrators to install the supplied backported packages and restart the relevant server processes, preserving and merging local configuration changes where necessary. Separate JBoss middleware releases also delivered broader security fixes: JBoss Fuse 6.1.0 addressed issues including XML signature spoofing, XXE, authentication downgrade, denial of service, and credential exposure, while JBoss BRMS 6.0.3 corrected Important-severity flaws including potential remote code execution through Xalan-Java secure-processing bypasses, OpenSAML XXE, excessive Java Security Manager permissions, and plaintext request-parameter logging.
Aug 31, 2026
Red Hat released moderate-severity updates for **JBoss Enterprise Application Platform (EAP) 6.3.3/6.3.z** on Red Hat Enterprise Linux 5, 6, and 7, addressing five flaws in RESTEasy XML handling, RBAC, JacORB, security-domain selection, and Weld conversation-state processing. The most externally reachable issue, `CVE-2014-7839`, allowed XML external entity expansion through a RESTEasy endpoint, potentially exposing files readable by the application-server account. The updates also remediate `CVE-2014-7849`, through which an authenticated RBAC Maintainer could alter a limited set of protected attributes, and `CVE-2014-7853`, which exposed sensitive security-domain data to authenticated users with incorrectly sufficient attribute permissions. Organizations should apply the relevant RHSA-2015:0215, RHSA-2015:0216, or RHSA-2015:0218 packages—including the RHEL 5 component updates—and restart JBoss server processes to activate the fixes.
Aug 29, 2026
Red Hat released Moderate-severity updates for JBoss Enterprise Application Platform (EAP) 6.2 on Red Hat Enterprise Linux 5 and 6, advancing deployments from version 6.2.3 to 6.2.4. The fixes address five vulnerabilities affecting Apache CXF and the JBoss JAX-RS implementation, including a SAML-token validation bypass, XML external entity (XXE) information disclosure, denial-of-service conditions, and potential plaintext credential exposure in a specific Apache CXF client-policy configuration. The XXE flaw, tracked as `CVE-2014-3481`, affects RESTEasy applications using JBoss EAP default context parameters that did not explicitly disable external-entity expansion. Unauthenticated attackers could submit crafted XML to applications accepting XML input to read local files, cause server-side HTTP requests that bypass network restrictions, or exhaust CPU and memory. Red Hat advised affected administrators to install the updated EAP packages, restart JBoss, preserve customized configurations, and review and merge any generated `.rpmnew` configuration changes.
Aug 29, 2026