Red Hat JBoss EAP 8.1.9 Fixes Authentication Bypass, Data Exposure and DoS Flaws

Red Hat released JBoss Enterprise Application Platform 8.1.9, replacing 8.1.8, to address five listed vulnerabilities in Apache CXF and Netty. Advisory RHSA-2026:92059, rated Important, covers RHEL 10 x86_64; related advisories provide fixes for RHEL 8 and 9. Netty’s CVE-2026-59903 can expose authenticated responses across users when its CORS handler overwrites application-defined Vary headers and proxies or CDNs cache the responses. Apache CXF fixes cover denial of service through excessive attachment headers (CVE-2026-64958) or uncontrolled form parameters (CVE-2026-57819), XML external entity processing during WSDL/XSD imports (CVE-2026-65432), and authentication bypass through crafted OIDC self-issued ID tokens (CVE-2026-65583). The authentication flaw requires a configuration permitting self-issued tokens, which are not accepted by default; the attachment-header flaw stems from an incomplete earlier fix.

The update also upgrades Bouncy Castle from 1.85 to 1.86, addressing numerous cryptographic vulnerabilities, including NTRU and HQC private-key side channels, unbounded password-based key-derivation costs, and validation weaknesses affecting MLS, OpenPGP, CMS and X.509 processing. Administrators should apply the appropriate JBoss EAP update after installing relevant prior errata and backing up applications, configurations and databases. For independently managed dependencies, Apache CXF fixes are available in 4.2.3, 4.1.8 and 3.6.12, including a default limit of 500 form parameters; Netty fixes are available in 4.1.137.Final and 4.2.17.Final. Prioritize exposed CXF services, deployments accepting self-issued OIDC tokens, and Netty applications serving authenticated content through shared caches.