Red Hat Product Errata RHSA-2026:33372 - Security Advisory Issued: 2026-06-30 Updated: 2026-06-30 RHSA-2026:33372 - Security Advisory Overview Updated Packages Synopsis Important: Red Hat JBoss Enterprise Application Platform 7.1.15 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.15 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.14, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.15 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543) org.apache.cxf/cxf-core: Apache CXF: Denial of Service vulnerability with temporary files (CVE-2025-23184) undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Affected Products JBoss Enterprise Application Platform 7.1 EUS 7.1 x86_64 Fixes BZ - 2339095 - CVE-2025-23184 org.apache.cxf: Apache CXF: Denial of Service vulnerability with temporary files BZ - 2392306 - CVE-2025-9784 undertow: Undertow MadeYouReset HTTP/2 DDoS Vulnerability BZ - 2408784 - CVE-2025-12543 undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF JBEAP-31620 - Tracker bug for the EAP 7.1.15 release for RHEL-7 JBEAP-33273 - (7.1.z) Upgrade undertow from 1.4.18.SP18 to 1.4.18.SP19 JBEAP-33278 - [7.1] Upgrade wildfly-core from 3.0.31.Final-redhat-00001 to 3.0.32.Final-redhat-00001 CVEs CVE-2025-9784 CVE-2025-12543 CVE-2025-23184 References https://access.redhat.com/security/updates/classification/#important https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1 https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/7.1.0_release_notes/index Note: More recent versions of these packages may be available. Click a package name for more details. JBoss Enterprise Application Platform 7.1 EUS 7.1 SRPM eap7-apache-cxf-3.1.16-7.redhat_00007.1.ep7.el7.src.rpm SHA-256: 6f4ee19f198b12ee45d96cdfe5bb7edad31bf7c38ac5b0e716969a67113e9555 eap7-undertow-1.4.18-21.SP19_redhat_00001.1.ep7.el7.src.rpm SHA-256: ae4d68318c789786bee6e65d739a3bb97379891fb8cc01ca95e072d8a9a7497f eap7-wildfly-7.1.15-3.GA_redhat_00002.1.ep7.el7.src.rpm SHA-256: 26e26dc69769b223403937672785e0290aad7b485dc5d56078af9a01b10e343b x86_64 eap7-apache-cxf-3.1.16-7.redhat_00007.1.ep7.el7.noarch.rpm SHA-256: ab6a47ddca286d9fe5f2cd28a583c8aa2d779f7ecfa278e20c0bed4c178a6099 eap7-apache-cxf-rt-3.1.16-7.redhat_00007.1.ep7.el7.noarch.rpm SHA-256: e50133420eeb62ee60e15f156f3cf9e0dd66c38f575bdccf938db7edda82a067 eap7-apache-cxf-services-3.1.16-7.redhat_00007.1.ep7.el7.noarch.rpm SHA-256: 22300cf816c2e27a2b732af2d3c2021c1f34835ed06b932dd614c12f9259cbc7 eap7-apache-cxf-tools-3.1.16-7.redhat_00007.1.ep7.el7.noarch.rpm SHA-256: 741bd0c9f735d9f3e76dc6e5690430c18587dc30b5164fd051fd94d791e5be68 eap7-undertow-1.4.18-21.SP19_redhat_00001.1.ep7.el7.noarch.rpm SHA-256: 654e1688ce1b0fe576b7217ccb6eeebf03b8337842f85c03a4dd6534c629c704 eap7-wildfly-7.1.15-3.GA_redhat_00002.1.ep7.el7.noarch.rpm SHA-256: 5f806d04ecffb8aa8a8bf62a248d3653f97a721af69694082cb3f1438c5e5537 eap7-wildfly-modules-7.1.15-3.GA_redhat_00002.1.ep7.el7.noarch.rpm SHA-256: db5e33f96f808028aeb2bf7eb6ec89c40853f8cbc98825c556a0df7277a68c5e The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .