Redhat
Redhat Jboss Enterprise Application Platform Expansion Pack: vulnerabilidades y CVE
Redhat Jboss Enterprise Application Platform Expansion Pack tiene 23 vulnerabilidades publicadas, 15 de ellas en los últimos 12 meses. 4 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE23
Últimos 12 meses15
Críticas4
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-18967 | Alta (8.1) | 0.23% | — | 6 ago 2026 | A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in… |
| CVE-2026-16102 | Alta (8.1) | 0.46% | — | 5 ago 2026 | A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers,… |
| CVE-2026-15573 | Alta (8.1) | 0.46% | — | 5 ago 2026 | A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra… |
| CVE-2026-16093 | Media (5.4) | 0.39% | — | 17 jul 2026 | Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be… |
| CVE-2026-15945 | Baja (2.7) | 0.35% | — | 16 jul 2026 | A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view… |
| CVE-2026-14209 | Media (4.3) | 0.39% | — | 30 jun 2026 | A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who… |
| CVE-2026-41731 | Alta (8.1) | 0.65% | — | 10 jun 2026 | JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined… |
| CVE-2026-28369 | Crítica (9.1) | 0.89% | — | 27 mar 2026 | A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior,… |
| CVE-2026-28368 | Crítica (9.1) | 0.89% | — | 27 mar 2026 | A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in… |
| CVE-2026-28367 | Crítica (9.1) | 0.89% | — | 27 mar 2026 | A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions… |
| CVE-2026-3121 | Alta (7.2) | 0.53% | — | 26 mar 2026 | A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate… |
| CVE-2026-4874 | Baja (3.1) | 0.33% | — | 26 mar 2026 | A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak… |
| CVE-2026-4366 | Media (5.8) | 0.39% | — | 18 mar 2026 | A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick… |
| CVE-2026-3009 | Alta (8.1) | 0.49% | — | 5 mar 2026 | A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows… |
| CVE-2025-12543 | Crítica (9.6) | 1.3% | — | 7 ene 2026 | A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result,… |
| CVE-2025-9784 | Alta (7.5) | 2.3% | — | 2 sept 2025 | A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to… |
| CVE-2025-5731 | Media (5.5) | 0.17% | — | 26 jun 2025 | A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a… |
| CVE-2023-4503 | Alta (7.5) | 0.72% | — | 6 feb 2024 | An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP… |
| CVE-2023-1108 | Alta (7.5) | 1.8% | — | 14 sept 2023 | A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. |
| CVE-2022-1278 | Alta (7.5) | 0.86% | — | 13 sept 2022 | A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain. |
| CVE-2022-0853 | Alta (7.5) | 1.5% | — | 11 mar 2022 | A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability. |
| CVE-2021-3642 | Media (5.3) | 0.85% | — | 5 ago 2021 | A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this… |
| CVE-2021-20250 | Media (4.3) | 0.74% | — | 13 may 2021 | A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.
Otros productos de Redhat
Enterprise Linux · 1937Enterprise Linux Desktop · 1928Enterprise Linux Server · 1891Enterprise Linux Workstation · 1845Enterprise Linux Server AUS · 1059Enterprise Linux EUS · 787Enterprise Linux Server TUS · 768Enterprise Linux Server EUS · 622Openshift Container Platform · 328Jboss Enterprise Application Platform · 244Satellite · 239Linux · 230