Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
15 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-101292 | fixed in 0:2.16.0-22.redhat_00057.1.el7eap | Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization | HIGH 8.2 | 0.5 % | ||
| CVE-2026-15567 | fixed in 0:2.16.0-22.redhat_00057.1.el7eap | Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener | HIGH 7.5 | 1.0 % | ||
| CVE-2026-15565 | fixed in 0:2.16.0-22.redhat_00057.1.el7eap | Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method | HIGH 7.5 | 1.2 % | ||
| CVE-2026-15563 | fixed in 0:2.16.0-22.redhat_00057.1.el7eap | Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos | HIGH 7.4 | 0.7 % | ||
| CVE-2026-15562 | fixed in 0:2.16.0-22.redhat_00057.1.el7eap | Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service | HIGH 7.5 | 1.0 % | ||
| CVE-2026-15561 | fixed in 0:2.16.0-22.redhat_00057.1.el7eap | Undertow-core: oom via missing limits in chunked trailer in eap's undertow | HIGH 7.5 | 0.8 % | ||
| CVE-2026-15560 | fixed in 0:2.16.0-22.redhat_00057.1.el7eap | Openjdk-orb: unauthed class loading via iiop in eap | HIGH 8.1 | 0.8 % | ||
| CVE-2026-15556 | fixed in 0:2.16.0-22.redhat_00057.1.el7eap | Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions | HIGH 8.1 | 0.3 % | ||
| CVE-2026-15555 | fixed in 0:2.16.0-22.redhat_00057.1.el7eap | Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller | HIGH 8.8 | 0.9 % | ||
| CVE-2026-15554 | fixed in 0:2.16.0-22.redhat_00057.1.el7eap | Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery | HIGH 7.4 | 0.6 % | ||
| CVE-2026-10579 | fixed in 0:2.16.0-22.redhat_00057.1.el7eap | Picketlink-federation: auth bypass in picketlink saml unsolicited-response | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-0603 | | Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection | HIGH 8.3 | 1.0 % | ||
| CVE-2025-12543 | fixed in 0:2.2.39-1.Final_redhat_00001.1.el7eap | Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf | CRITICAL 9.6 | 1.3 % | ||
| CVE-2024-3884 | | Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded | HIGH 7.5 | 1.4 % | ||
| CVE-2025-9784 | | Undertow: undertow madeyoureset http/2 ddos vulnerability | HIGH 7.5 | 2.3 % |