RHSA-2026:18054
Advisory lineage Upstream: 14 Downstream: 0
Published: 19 May 2026, 10:06
Last modified:20 Jul 2026, 10:08
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.1 CRITICAL
3.1 (osv_red_hat)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
19 May 2026, 10:06
Published
Vulnerability first disclosed
20 Jul 2026, 10:08
Last Modified
Vulnerability information updated
Description
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update
CVSS Metrics
- v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Systems
- redhat•eap8-activemq-artemis
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-cli
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-commons
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-core-client
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-dto
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-hornetq-protocol
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-hqclient-protocol
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-jakarta-client
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-jakarta-ra
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-jakarta-server
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-jakarta-service-extensions
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-jdbc-store
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-journal
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-selector
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-activemq-artemis-server
< 0:2.40.0-6.redhat_00012.1.el8eap
- redhat•eap8-angus
< 0:2.0.5-1.redhat_00001.1.el8eap
- redhat•eap8-angus-activation
< 0:2.0.3-1.redhat_00001.1.el8eap
- redhat•eap8-angus-mail
< 0:2.0.5-1.redhat_00001.1.el8eap
- redhat•eap8-bouncycastle
< 0:1.84.0-1.redhat_00001.1.el8eap
- redhat•eap8-bouncycastle-jmail
< 0:1.84.0-1.redhat_00001.1.el8eap
- redhat•eap8-bouncycastle-pg
< 0:1.84.0-1.redhat_00001.1.el8eap
- redhat•eap8-bouncycastle-pkix
< 0:1.84.0-1.redhat_00001.1.el8eap
- redhat•eap8-bouncycastle-prov
< 0:1.84.0-1.redhat_00001.1.el8eap
- redhat•eap8-bouncycastle-util
< 0:1.84.0-1.redhat_00001.1.el8eap
- redhat•eap8-eap-product-conf-parent
< 0:801.6.0-1.GA_redhat_00001.1.el8eap
- redhat•eap8-eap-product-conf-wildfly-ee-feature-pack
< 0:801.6.0-1.GA_redhat_00001.1.el8eap
- redhat•eap8-guava
< 0:33.0.0-3.jre_redhat_00004.1.el8eap
- redhat•eap8-guava-failureaccess
< 0:1.0.3-1.redhat_00001.1.el8eap
- redhat•eap8-guava-libraries
< 0:33.0.0-3.jre_redhat_00004.1.el8eap
- redhat•eap8-hal-console
< 0:3.7.19-1.Final_redhat_00001.1.el8eap
- redhat•eap8-hibernate
< 0:6.6.48-1.Final_redhat_00001.1.el8eap
- redhat•eap8-hibernate-core
< 0:6.6.48-1.Final_redhat_00001.1.el8eap
- redhat•eap8-hibernate-envers
< 0:6.6.48-1.Final_redhat_00001.1.el8eap
- redhat•eap8-hibernate-search
< 0:7.2.6-1.Final_redhat_00001.1.el8eap
- redhat•eap8-hibernate-search-backend-elasticsearch
< 0:7.2.6-1.Final_redhat_00001.1.el8eap
- redhat•eap8-hibernate-search-backend-lucene
< 0:7.2.6-1.Final_redhat_00001.1.el8eap
- redhat•eap8-hibernate-search-engine
< 0:7.2.6-1.Final_redhat_00001.1.el8eap
- redhat•eap8-hibernate-search-mapper-orm
< 0:7.2.6-1.Final_redhat_00001.1.el8eap
- redhat•eap8-hibernate-search-mapper-pojo-base
< 0:7.2.6-1.Final_redhat_00001.1.el8eap
- redhat•eap8-hibernate-search-util-common
< 0:7.2.6-1.Final_redhat_00001.1.el8eap
- redhat•eap8-jakarta-activation
< 0:2.1.4-1.redhat_00001.1.el8eap
- redhat•eap8-jboss-logging
< 0:3.6.2-1.Final_redhat_00001.1.el8eap
- redhat•eap8-jboss-metadata
< 0:16.1.0-1.Final_redhat_00001.1.el8eap
- redhat•eap8-jboss-metadata-appclient
< 0:16.1.0-1.Final_redhat_00001.1.el8eap
- redhat•eap8-jboss-metadata-common
< 0:16.1.0-1.Final_redhat_00001.1.el8eap
- redhat•eap8-jboss-metadata-ear
< 0:16.1.0-1.Final_redhat_00001.1.el8eap
- redhat•eap8-jboss-metadata-ejb
< 0:16.1.0-1.Final_redhat_00001.1.el8eap
- redhat•eap8-jboss-metadata-web
< 0:16.1.0-1.Final_redhat_00001.1.el8eap
- redhat•eap8-jctools
< 0:4.0.6-1.redhat_00001.1.el8eap
- redhat•eap8-jctools-core
< 0:4.0.6-1.redhat_00001.1.el8eap
Showing first 50 affected entries in server-rendered view.
References (117)
- https://access.redhat.com/errata/RHSA-2026:18054
- https://access.redhat.com/security/updates/classification/#important
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/red_hat_jboss_enterprise_application_platform_installation_methods/index
- https://access.redhat.com/articles/7134190
- https://bugzilla.redhat.com/show_bug.cgi?id=2337621
- https://bugzilla.redhat.com/show_bug.cgi?id=2441268
- https://bugzilla.redhat.com/show_bug.cgi?id=2442671
- https://bugzilla.redhat.com/show_bug.cgi?id=2442908
- https://bugzilla.redhat.com/show_bug.cgi?id=2442922
- https://bugzilla.redhat.com/show_bug.cgi?id=2444320
- https://bugzilla.redhat.com/show_bug.cgi?id=2452453
- https://bugzilla.redhat.com/show_bug.cgi?id=2452456
- https://bugzilla.redhat.com/show_bug.cgi?id=2458634
- https://bugzilla.redhat.com/show_bug.cgi?id=2458635
- https://bugzilla.redhat.com/show_bug.cgi?id=2458638
- https://bugzilla.redhat.com/show_bug.cgi?id=2458640
- https://bugzilla.redhat.com/show_bug.cgi?id=2458641
- https://issues.redhat.com/browse/JBEAP-29032
- https://issues.redhat.com/browse/JBEAP-31314
- https://issues.redhat.com/browse/JBEAP-31468
- https://issues.redhat.com/browse/JBEAP-31868
- https://issues.redhat.com/browse/JBEAP-31874
- https://issues.redhat.com/browse/JBEAP-32025
- https://issues.redhat.com/browse/JBEAP-32028
- https://issues.redhat.com/browse/JBEAP-32064
- https://issues.redhat.com/browse/JBEAP-32074
- https://issues.redhat.com/browse/JBEAP-32078
- https://issues.redhat.com/browse/JBEAP-32084
- https://issues.redhat.com/browse/JBEAP-32123
- https://issues.redhat.com/browse/JBEAP-32209
- https://issues.redhat.com/browse/JBEAP-32212
- https://issues.redhat.com/browse/JBEAP-32266
- https://issues.redhat.com/browse/JBEAP-32293
- https://issues.redhat.com/browse/JBEAP-32295
- https://issues.redhat.com/browse/JBEAP-32339
- https://issues.redhat.com/browse/JBEAP-32350
- https://issues.redhat.com/browse/JBEAP-32415
- https://issues.redhat.com/browse/JBEAP-32481
- https://issues.redhat.com/browse/JBEAP-32486
- https://issues.redhat.com/browse/JBEAP-32544
- https://issues.redhat.com/browse/JBEAP-32601
- https://issues.redhat.com/browse/JBEAP-32687
- https://issues.redhat.com/browse/JBEAP-32755
- https://issues.redhat.com/browse/JBEAP-32773
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18054.json
- https://access.redhat.com/security/cve/CVE-2025-14813
- https://www.cve.org/CVERecord?id=CVE-2025-14813
- https://nvd.nist.gov/vuln/detail/CVE-2025-14813
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9014813
- https://access.redhat.com/security/cve/CVE-2025-23368
- https://www.cve.org/CVERecord?id=CVE-2025-23368
- https://nvd.nist.gov/vuln/detail/CVE-2025-23368
- https://www.gruppotim.it/it/footer/red-team.html
- https://access.redhat.com/security/cve/CVE-2026-0636
- https://www.cve.org/CVERecord?id=CVE-2026-0636
- https://nvd.nist.gov/vuln/detail/CVE-2026-0636
- https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636
- https://access.redhat.com/security/cve/CVE-2026-3505
- https://www.cve.org/CVERecord?id=CVE-2026-3505
- https://nvd.nist.gov/vuln/detail/CVE-2026-3505
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%903505
- https://access.redhat.com/security/cve/CVE-2026-5588
- https://www.cve.org/CVERecord?id=CVE-2026-5588
- https://nvd.nist.gov/vuln/detail/CVE-2026-5588
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588
- https://access.redhat.com/security/cve/CVE-2026-5598
- https://www.cve.org/CVERecord?id=CVE-2026-5598
- https://nvd.nist.gov/vuln/detail/CVE-2026-5598
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905998
- https://access.redhat.com/security/cve/CVE-2026-26996
- https://www.cve.org/CVERecord?id=CVE-2026-26996
- https://nvd.nist.gov/vuln/detail/CVE-2026-26996
- https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
- https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
- https://access.redhat.com/security/cve/CVE-2026-27446
- https://www.cve.org/CVERecord?id=CVE-2026-27446
- https://nvd.nist.gov/vuln/detail/CVE-2026-27446
- https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg
- https://access.redhat.com/security/cve/CVE-2026-27727
- https://www.cve.org/CVERecord?id=CVE-2026-27727
- https://nvd.nist.gov/vuln/detail/CVE-2026-27727
- https://github.com/swaldman/mchange-commons-java/security/advisories/GHSA-m2cm-222f-qw44
- https://mogwailabs.de/en/blog/2025/02/c3p0-you-little-rascal
- https://www.mchange.com/projects/c3p0/#configuring_security
- https://www.mchange.com/projects/c3p0/#security-note
- https://access.redhat.com/security/cve/CVE-2026-27830
- https://www.cve.org/CVERecord?id=CVE-2026-27830
- https://nvd.nist.gov/vuln/detail/CVE-2026-27830
- https://github.com/swaldman/c3p0/commit/e14cbd8166e423e2e9a9d6f08b2add3433492d6e
- https://github.com/swaldman/c3p0/security/advisories/GHSA-5476-xc4j-rqcv
- https://access.redhat.com/security/cve/CVE-2026-27904
- https://www.cve.org/CVERecord?id=CVE-2026-27904
- https://nvd.nist.gov/vuln/detail/CVE-2026-27904
- https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
- https://access.redhat.com/security/cve/CVE-2026-33870
- https://www.cve.org/CVERecord?id=CVE-2026-33870
- https://nvd.nist.gov/vuln/detail/CVE-2026-33870
- https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8
- https://w4ke.info/2025/06/18/funky-chunks.html
- https://w4ke.info/2025/10/29/funky-chunks-2.html
- https://www.rfc-editor.org/rfc/rfc9110
- https://access.redhat.com/security/cve/CVE-2026-33871
- https://www.cve.org/CVERecord?id=CVE-2026-33871
- https://nvd.nist.gov/vuln/detail/CVE-2026-33871
- https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv
- https://bugzilla.redhat.com/show_bug.cgi?id=2451409
- https://access.redhat.com/security/cve/CVE-2025-67030
- https://www.cve.org/CVERecord?id=CVE-2025-67030
- https://nvd.nist.gov/vuln/detail/CVE-2025-67030
- https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec
- https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642
- https://github.com/codehaus-plexus/plexus-utils/issues/294
- https://github.com/codehaus-plexus/plexus-utils/pull/295
- https://github.com/codehaus-plexus/plexus-utils/pull/296