Product by Red Hat
Jboss Enterprise Application Platform Expansion Pack
23 known vulnerabilities in Jboss Enterprise Application Platform Expansion Pack (Red Hat), 0 of them actively exploited (CISA KEV).
Key figures
23
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2025-9784 | Undertow: undertow madeyoureset http/2 ddos vulnerability | 7.5 | |
| Critical | CVE-2025-12543 | Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11: Improper Input Validation | 9.6 | |
| High | CVE-2023-1108 | Undertow: infinite loop in sslconduit during close | 7.5 | |
| Critical | CVE-2026-28368 | Undertow: undertow: request smuggling via inconsistent header parsing | 9.1 | |
| Critical | CVE-2026-28369 | Undertow: undertow: request smuggling via malformed http request headers | 9.1 | |
| Critical | CVE-2026-28367 | Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator | 8.7 | |
| High | CVE-2022-0853 | Jboss-client: Memory Leak | 7.5 | |
| High | CVE-2026-15573 | Red Hat: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | 8.1 | |
| High | CVE-2026-16102 | Red Hat: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | 8.1 | |
| High | CVE-2026-41731 | Spring for Apache Kafka: Deserialization of Untrusted Data | 8.1 | |
| High | CVE-2022-1278 | WildFly: Initialization of a Resource with an Insecure Default | 7.5 | |
| High | CVE-2026-3009 | Red Hat: Incorrect Authorization | 8.1 | |
| High | CVE-2026-3121 | Red Hat: Incorrect Privilege Assignment | 6.5 | |
| High | CVE-2023-4503 | Eap-galleon: custom provisioning creates unsecured http-invoker | 6.8 | |
| Medium | CVE-2026-16093 | Red Hat: Reliance on Untrusted Inputs in a Security Decision | 5.4 | |
| High | CVE-2026-18967 | Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow | 6.4 | |
| Medium | CVE-2026-15945 | Red Hat: Authorization Bypass Through User-Controlled Key | 4.3 | |
| Medium | CVE-2021-3642 | Wildfly-elytron: Observable Discrepancy | 5.3 | |
| Medium | CVE-2026-14209 | Red Hat: Authorization Bypass Through User-Controlled Key | 4.3 | |
| Medium | CVE-2026-4366 | Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak | 5.8 | |
| Medium | CVE-2021-20250 | Wildfly: Exposure of Sensitive Information to an Unauthorized Actor | 4.3 | |
| Low | CVE-2026-4874 | Red Hat: Server-Side Request Forgery (SSRF) | 3.1 | |
| Medium | CVE-2025-5731 | Infinispan: credential leakage in infinispan cli | 5.5 |