Red Hat JBoss Core Services vulnerabilities

36 CVEs affecting Red Hat JBoss Core Services, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-6732, published 2026-04-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF), published 2021-09-16. Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2021-12-01. EPSS: 100% chance of exploitation in the next 30 days. A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2019-0211: Apache HTTP Server Privilege Escalation Vulnerability, published 2019-04-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 65% chance of exploitation in the next 30 days. In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process…
CVE-2018-11759, published 2018-10-31. High severity, CVSS 7.5. EPSS: 90.6% chance of exploitation in the next 30 days. The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge…
CVE-2019-9515, published 2019-08-13. High severity, CVSS 7.5. EPSS: 87.4% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the…
CVE-2019-9514, published 2019-08-13. High severity, CVSS 7.5. EPSS: 82.8% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that…
CVE-2019-9513, published 2019-08-13. High severity, CVSS 7.5. EPSS: 81.6% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the…
CVE-2019-9511, published 2019-08-13. High severity, CVSS 7.5. EPSS: 59.5% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data…
CVE-2017-9788, published 2017-07-13. Critical severity, CVSS 9.1. EPSS: 56.8% chance of exploitation in the next 30 days. In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value…
CVE-2019-9516, published 2019-08-13. Medium severity, CVSS 6.5. EPSS: 56.3% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value,…

Latest

CVE-2026-6732, published 2026-04-23. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An…
CVE-2026-0992, published 2026-01-15. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same…
CVE-2026-0990, published 2026-01-15. Medium severity, CVSS 5.9. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that…
CVE-2026-0989, published 2026-01-15. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include>…
CVE-2025-6170, published 2025-06-16. Low severity, CVSS 2.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly,…
CVE-2025-6021, published 2025-06-12. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a…
CVE-2021-3541, published 2021-07-09. Medium severity, CVSS 6.5. EPSS: 2.1% chance of exploitation in the next 30 days. A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
CVE-2021-3516, published 2021-06-01. High severity, CVSS 7.8. EPSS: 2% chance of exploitation in the next 30 days. There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this…