RHSA-2026:4915

Description

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update

CVSS Metrics

• v3.1•CRITICAL•Score: 9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Affected Systems

• redhat•eap7-apache-cxf

  < 0:3.5.11-1.SP1_redhat_00001.1.el7eap

• redhat•eap7-apache-cxf-rt

  < 0:3.5.11-1.SP1_redhat_00001.1.el7eap

• redhat•eap7-apache-cxf-services

  < 0:3.5.11-1.SP1_redhat_00001.1.el7eap

• redhat•eap7-apache-cxf-tools

  < 0:3.5.11-1.SP1_redhat_00001.1.el7eap

• redhat•eap7-eclipse-jgit

  < 0:5.13.5.202508271544-2.r_redhat_00001.1.el7eap

• redhat•eap7-hibernate

  < 0:5.3.38-1.Final_redhat_00001.1.el7eap

• redhat•eap7-hibernate-core

  < 0:5.3.38-1.Final_redhat_00001.1.el7eap

• redhat•eap7-hibernate-entitymanager

  < 0:5.3.38-1.Final_redhat_00001.1.el7eap

• redhat•eap7-hibernate-envers

  < 0:5.3.38-1.Final_redhat_00001.1.el7eap

• redhat•eap7-hibernate-java8

  < 0:5.3.38-1.Final_redhat_00001.1.el7eap

• redhat•eap7-jboss-marshalling

  < 0:2.0.16-1.Final_redhat_00001.1.el7eap

• redhat•eap7-jboss-marshalling-river

  < 0:2.0.16-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-all

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-buffer

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-codec

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-codec-dns

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-codec-haproxy

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-codec-http

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-codec-http2

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-codec-memcache

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-codec-mqtt

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-codec-redis

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-codec-smtp

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-codec-socks

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-codec-stomp

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-codec-xml

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-common

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-handler

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-handler-proxy

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-resolver

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-resolver-dns

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-resolver-dns-classes-macos

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-transport

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-transport-classes-epoll

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-transport-classes-kqueue

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-transport-native-epoll

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-transport-native-epoll-debuginfo

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-transport-native-unix-common

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-netty-transport-sctp

  < 0:4.1.124-1.Final_redhat_00001.1.el7eap

• redhat•eap7-undertow

  < 0:2.2.39-1.Final_redhat_00001.1.el7eap

• redhat•eap7-wildfly

  < 0:7.4.24-4.GA_redhat_00002.1.el7eap

• redhat•eap7-wildfly-java-jdk11

  < 0:7.4.24-4.GA_redhat_00002.1.el7eap

• redhat•eap7-wildfly-java-jdk8

  < 0:7.4.24-4.GA_redhat_00002.1.el7eap

• redhat•eap7-wildfly-javadocs

  < 0:7.4.24-4.GA_redhat_00002.1.el7eap

• redhat•eap7-wildfly-modules

  < 0:7.4.24-4.GA_redhat_00002.1.el7eap

References (54)

• https://access.redhat.com/errata/RHSA-2026:4915
• https://access.redhat.com/security/updates/classification/#important
• https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4
• https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index
• https://bugzilla.redhat.com/show_bug.cgi?id=2275287
• https://bugzilla.redhat.com/show_bug.cgi?id=2313454
• https://bugzilla.redhat.com/show_bug.cgi?id=2367730
• https://bugzilla.redhat.com/show_bug.cgi?id=2374804
• https://bugzilla.redhat.com/show_bug.cgi?id=2387221
• https://bugzilla.redhat.com/show_bug.cgi?id=2388252
• https://bugzilla.redhat.com/show_bug.cgi?id=2392306
• https://bugzilla.redhat.com/show_bug.cgi?id=2408784
• https://bugzilla.redhat.com/show_bug.cgi?id=2427147
• https://issues.redhat.com/browse/JBEAP-30074
• https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4915.json
• https://access.redhat.com/security/cve/CVE-2024-3884
• https://www.cve.org/CVERecord?id=CVE-2024-3884
• https://nvd.nist.gov/vuln/detail/CVE-2024-3884
• https://access.redhat.com/security/cve/CVE-2024-7254
• https://www.cve.org/CVERecord?id=CVE-2024-7254
• https://nvd.nist.gov/vuln/detail/CVE-2024-7254
• https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa
• https://access.redhat.com/security/cve/CVE-2025-4949
• https://www.cve.org/CVERecord?id=CVE-2025-4949
• https://nvd.nist.gov/vuln/detail/CVE-2025-4949
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/64
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281
• https://projects.eclipse.org/projects/technology.jgit/releases/7.2.1
• https://access.redhat.com/security/cve/CVE-2025-9784
• https://www.cve.org/CVERecord?id=CVE-2025-9784
• https://nvd.nist.gov/vuln/detail/CVE-2025-9784
• https://github.com/undertow-io/undertow/pull/1778
• https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final
• https://issues.redhat.com/browse/UNDERTOW-2598
• https://kb.cert.org/vuls/id/767506
• https://access.redhat.com/security/cve/CVE-2025-12543
• https://www.cve.org/CVERecord?id=CVE-2025-12543
• https://nvd.nist.gov/vuln/detail/CVE-2025-12543
• https://access.redhat.com/security/cve/CVE-2025-48913
• https://www.cve.org/CVERecord?id=CVE-2025-48913
• https://nvd.nist.gov/vuln/detail/CVE-2025-48913
• https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83
• https://access.redhat.com/security/cve/CVE-2025-52999
• https://www.cve.org/CVERecord?id=CVE-2025-52999
• https://nvd.nist.gov/vuln/detail/CVE-2025-52999
• https://github.com/FasterXML/jackson-core/pull/943
• https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3
• https://access.redhat.com/security/cve/CVE-2025-55163
• https://www.cve.org/CVERecord?id=CVE-2025-55163
• https://nvd.nist.gov/vuln/detail/CVE-2025-55163
• https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4
• https://access.redhat.com/security/cve/CVE-2026-0603
• https://www.cve.org/CVERecord?id=CVE-2026-0603
• https://nvd.nist.gov/vuln/detail/CVE-2026-0603