Red Hat Fuse 7 vulnerabilities

82 CVEs affecting Red Hat Fuse 7, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-84823, published 2026-10-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-5971, published 2024-07-08. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not…
CVE-2026-93567, published 2026-09-18. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for…
CVE-2026-93569, published 2026-09-18. High severity, CVSS 8.2. EPSS: 2.2% chance of exploitation in the next 30 days. A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form…
CVE-2026-27830, published 2026-02-26. High severity, CVSS 8.0. EPSS: 2% chance of exploitation in the next 30 days. c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource`…
CVE-2024-3653, published 2024-07-08. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler…
CVE-2024-6162, published 2024-06-20. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode…
CVE-2024-1023, published 2024-03-27. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to…
CVE-2024-3884, published 2025-12-03. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding…
CVE-2026-93574, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit…
CVE-2026-6857, published 2026-04-22. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by…

Latest

CVE-2026-84823, published 2026-10-16. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot`…
CVE-2026-85634, published 2026-10-15. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the…
CVE-2026-94449, published 2026-09-21. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the…
CVE-2026-93562, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP…
CVE-2026-93432, published 2026-09-18. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard…
CVE-2026-93579, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due…
CVE-2026-93576, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an…
CVE-2026-93573, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple…