Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
7 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-28369 | | Undertow: undertow: request smuggling via malformed http request headers | CRITICAL 9.1 | 0.7 % | ||
| CVE-2026-28367 | | Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator | CRITICAL 9.1 | 0.7 % | ||
| CVE-2026-28368 | | Undertow: undertow: request smuggling via inconsistent header parsing | CRITICAL 9.1 | 0.7 % | ||
| CVE-2025-12543 | | Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf | CRITICAL 9.6 | 1.3 % | ||
| CVE-2024-3884 | | Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded | HIGH 7.5 | 1.4 % | ||
| CVE-2025-9784 | | Undertow: undertow madeyoureset http/2 ddos vulnerability | HIGH 7.5 | 2.3 % | ||
| CVE-2025-23368 | fixed in 0:8.1.6-5.GA_redhat_00007.1.el9eap | Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli | HIGH 8.1 | 0.9 % |