Red Hat JBoss Enterprise Application Platform 7.4.24 vulnerabilities

2 CVEs affecting Red Hat JBoss Enterprise Application Platform 7.4.24, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-0603, published 2026-01-23.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-3884, published 2025-12-03. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding…
• CVE-2026-0603, published 2026-01-23. High severity, CVSS 8.3. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters…