CVE-2021-20318: Red Hat JBoss Enterprise Application Platform

High severity, CVSS 7.2. EPSS: 1.7% chance of exploitation in the next 30 days.

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.

Affected products

• Red Hat JBoss Enterprise Application Platform: version 7.3.9 only; version 7.4.0 only

Published 2021-12-23. Last modified 2026-06-17.