Red Hat JBoss Enterprise Application Platform Expansion Pack vulnerabilities

23 CVEs affecting Red Hat JBoss Enterprise Application Platform Expansion Pack, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-18967, published 2026-08-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-9784, published 2025-09-02. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows…
CVE-2023-1108, published 2023-09-14. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
CVE-2022-0853, published 2022-03-11. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability.
CVE-2025-12543, published 2026-01-07. Critical severity, CVSS 9.6. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP…
CVE-2026-28367, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers,…
CVE-2026-28369, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading…
CVE-2026-28368, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies.…
CVE-2022-1278, published 2022-09-13. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
CVE-2021-3642, published 2021-08-05. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest…
CVE-2021-20250, published 2021-05-13. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this…

Latest

CVE-2026-18967, published 2026-08-06. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the…
CVE-2026-16102, published 2026-08-05. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User…
CVE-2026-15573, published 2026-08-05. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By…
CVE-2026-16093, published 2026-07-17. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this…
CVE-2026-15945, published 2026-07-16. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access…
CVE-2026-14209, published 2026-06-30. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an…
CVE-2026-41731, published 2026-06-10. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its…