Red Hat Fuse vulnerabilities

29 CVEs affecting Red Hat Fuse, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-41731, published 2026-06-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability, published 2017-10-04. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 100% chance of exploitation in the next 30 days. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the…
CVE-2015-1427: Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability, published 2015-02-17. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 99.9% chance of exploitation in the next 30 days. The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted…
CVE-2016-4437: Apache Shiro Code Execution Vulnerability, published 2016-06-07. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 93% chance of exploitation in the next 30 days. Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an…
CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2018-1270, published 2018-04-06. Critical severity, CVSS 9.8. EPSS: 77.5% chance of exploitation in the next 30 days. Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory…
CVE-2019-0201, published 2019-05-23. Medium severity, CVSS 5.9. EPSS: 9.7% chance of exploitation in the next 30 days. An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and…
CVE-2017-7957, published 2017-04-29. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application…
CVE-2024-1635, published 2024-02-19. High severity, CVSS 7.5. EPSS: 4.6% chance of exploitation in the next 30 days. A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port…
CVE-2019-10174, published 2019-11-25. High severity, CVSS 8.8. EPSS: 3.1% chance of exploitation in the next 30 days. A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with…
CVE-2018-1199, published 2018-03-16. Medium severity, CVSS 5.3. EPSS: 2.9% chance of exploitation in the next 30 days. Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters…

Latest

CVE-2026-41731, published 2026-06-10. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its…
CVE-2026-28369, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading…
CVE-2026-28368, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies.…
CVE-2026-28367, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers,…
CVE-2025-57849, published 2026-03-13. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. A container privilege escalation flaw was found in certain Fuse images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain…
CVE-2025-12543, published 2026-01-07. Critical severity, CVSS 9.6. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP…
CVE-2025-9784, published 2025-09-02. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows…
CVE-2023-1108, published 2023-09-14. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
CVE-2021-4178, published 2022-08-24. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and…