This security update addresses five vulnerabilities in the Netty library used by Red Hat JBoss EAP 8.1, including denial of service via TLS buffer allocation, hostname verification bypass, and DNS-related information disclosure and data manipulation. The CVSS scores for the three CVEs detailed in the NVD data are 7.5 (HIGH) for CVE-2026-45416 and CVE-2026-50010, and 8.7 (HIGH) for CVE-2026-45674. The underlying Netty library vulnerabilities affect versions prior to 4.1.135 and versions 4.2.0 through 4.2.14, which are resolved by upgrading Netty to version 4.1.135 or 4.2.15; the fix for JBoss EAP is contained within the 8.1.7 patch release.
Red Hat Product Errata RHSA-2026:49700 - Security Advisory Issued: 2026-08-03 Updated: 2026-08-03 RHSA-2026:49700 - Security Advisory Overview Updated Packages Synopsis Important: Red Hat JBoss Enterprise Application Platform 8.1.7 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is an update for Red Hat JBoss Enterprise Application Platform 8.1. See Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416) netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674) netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010) netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Affected Products JBoss Enterprise Application Platform 8.1 for RHEL 10 x86_64 JBoss Enterprise Application Platform 8.1 for RHEL 9 x86_64 JBoss Enterprise Application Platform 8.1 for RHEL 8 x86_64 Fixes BZ - 2488081 - CVE-2026-44249 netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation BZ - 2488391 - CVE-2026-45416 netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake BZ - 2488400 - CVE-2026-45674 netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation BZ - 2488429 - CVE-2026-50010 netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass BZ - 2488439 - CVE-2026-47691 io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records JBEAP-33514 - (8.1.z) Upgrade netty from 4.1.133.Final-redhat-00001 to 4.1.135.Final-redhat-00001 JBEAP-33903 - (8.1.z) Update EAP channel to use wildfly-ee-feature-pack-product-conf x.x.x in EAP 8.1 Update 7.1 CVEs CVE-2026-44249 CVE-2026-45416 CVE-2026-45674 CVE-2026-47691 CVE-2026-50010 References https://access.redhat.com/security/updates/classification/#important https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1 https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index https://access.redhat.com/articles/7129481 Note: More recent versions of these packages may be available. Click a package name for more details. JBoss Enterprise Application Platform 8.1 for RHEL 10 SRPM eap8-eap-product-conf-parent-801.7.1-1.GA_redhat_00001.1.el10eap.src.rpm SHA-256: 2bb46e0495ba4b9633130978489401db9fbe796a860413745be81d3dc9ec1d5e eap8-netty-4.1.135-1.Final_redhat_00001.1.el10eap.src.rpm SHA-256: 44ee42b51ca8886605329414445adb0d2f4e44ffaa89d1ebc66a5569dbcbecd2 eap8-netty-transport-native-epoll-4.1.135-1.Final_redhat_00001.1.el10eap.src.rpm SHA-256: 8da5287dcc28c13d7f29b6ef793343f2877b1ce36bf6dc07d39a89b86ee769b9 eap8-wildfly-8.1.7.1-1.GA_redhat_00004.1.el10eap.src.rpm SHA-256: 3cbf41e6eac9269bb71fb3faa6f1fc978e9baa3777856a95601e93b98b6f6fd7 x86_64 eap8-eap-product-conf-parent-801.7.1-1.GA_redhat_00001.1.el10eap.noarch.rpm SHA-256: 7d7762d7c15ad1714336f43b22a5b10083a14ff1952988ba19569befd0ad0296 eap8-eap-product-conf-wildfly-ee-feature-pack-801.7.1-1.GA_redhat_00001.1.el10eap.noarch.rpm SHA-256: ab62a12f020365916e792ad34700909dd020b9c00f07e6021138735fa728c746 eap8-netty-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: f7c7022ceb51e11e804756f76b6c202c0704211478be78e778daacdf6e328df9 eap8-netty-buffer-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: da67e284a4b8dedcf0bd02fff285a5c24d4c8cca0720d5827cb72d877ad5f048 eap8-netty-codec-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: 4652e4bbde0e135e868ebb07dd4bfa2712ac21056c9d7edfa036fe11f4b1e9d3 eap8-netty-codec-dns-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: c9da3730c7cf6a4b847b7afd62185fe8eeb0b4face82a2358d4769a7eaab866b eap8-netty-codec-http-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: 18a18829dcac536c6a6aaa1311b34549313afca9769b505998e0ebbd584e9591 eap8-netty-codec-socks-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: 1e6923a4c642fd0df514fa7bd0ca16b7b9ecb558af3edeff35991e11fb8f2e47 eap8-netty-common-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: 12dfa4d17a25bf9c6a18ac29f4455eaa26cbe93de91d7224d954e1a3cffdc228 eap8-netty-handler-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: 645045c6bd190138a26273a4ea015fd22fdb8b3abc70083b7470b2ceadc79bc0 eap8-netty-handler-proxy-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: fc3ffd8f6da60bd8048cb7caa89496ed3f4e7e91e7c6a42e9fbd2c4a054d39e3 eap8-netty-resolver-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: 08401a71df37611bad245155d102ec23e84c17d08bfcfc5d71519b30e3db9c45 eap8-netty-resolver-dns-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: 4ff0abaf598a5b4edd814e7ea158b9465e229d071373edb80d57a0fcd076040d eap8-netty-transport-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: 0202c07a71ba85a586f43a29c617c451150628f0df56e87220ed6f6c909e119f eap8-netty-transport-classes-epoll-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: 737623e0b5d5358738afe8a2b9457c03abfcff8bf1df2f493ca0c443be107a08 eap8-netty-transport-native-epoll-4.1.135-1.Final_redhat_00001.1.el10eap.x86_64.rpm SHA-256: 03f0e033b6c781512fff1581eca89ed23b3d3b22febb970bb4be3a6277cc8c94 eap8-netty-transport-native-epoll-debuginfo-4.1.135-1.Final_redhat_00001.1.el10eap.x86_64.rpm SHA-256: 9edd2ba432b2d8586108883d75747261f18eae55c1e8755bca46a0ecb38eda94 eap8-netty-transport-native-unix-common-4.1.135-1.Final_redhat_00001.1.el10eap.noarch.rpm SHA-256: 4a6ec16c9199606158609a4b2e3082a245c009d14b0c5cbcfe4e12559f422e2a eap8-wildfly-8.1.7.1-1.GA_redhat_00004.1.el10eap.noarch.rpm SHA-256: 92b3d3a99a4eb34378c864946ffa5b047c8f1fbe18aa94ab78a91684c1f5b0fd eap8-wildfly-java-jdk21-8.1.7.1-1.GA_redhat_00004.1.el10eap.noarch.rpm SHA-256: daa512ce97a7e376a2f5c0f9a615085d80381352c9cb2ca680cdbdc2d224b39d eap8-wildfly-modules-8.1.7.1-1.GA_redhat_00004.1.el10eap.noarch.rpm SHA-256: 5aad8b6bae7cc3bc066bb783fe10f1dab27e6c538e5f2b9314c670ef7adc6908 JBoss Enterprise Application Platform 8.1 for RHEL 9 SRPM eap8-eap-product-conf-parent-801.7.1-1.GA_redhat_00001.1.el9eap.src.rpm SHA-256: b542621dd47ac3fb04a9fd5362f9660331746a0159c4c450e389f07dc6bbcfb3 eap8-jose4j-0.9.6-2.redhat_00002.1.el9eap.src.rpm SHA-256: 6845cc43fefe481b308717d146d64ed8df3b1a3a0a7f710655bcbc5111c3be30 eap8-netty-4.1.135-1.Final_redhat_00001.1.el9eap.src.rpm SHA-256: ed09bceb8842e34fb2b496cdb337d9726385b444033c125bec3daec3ed02ac67 eap8-netty-transport-native-epoll-4.1.135-1.Final_redhat_00001.1.el9eap.src.rpm SHA-256: 7dcc1dc43188affb6e0d17b40c3fa443485c3a5eaf24d7cd0a07f1c428fb83fe eap8-wildfly-8.1.7.1-1.GA_redhat_00004.1.el9eap.src.rpm SHA-256: 54d5157f50dd01dd1ec7378704ad4c3d268d44b13b38505b37fd4ccc03d230f4 x86_64 eap8-eap-product-conf-parent-801.7.1-1.GA_redhat_00001.1.el9eap.noarch.rpm SHA-256: e70a5d8919ec01e8dc064bc0983ed42e3a61749b304e151d32192f556b5e33a5 eap8-eap-product-conf-wildfly-ee-feature-pack-801.7.1-1.GA_redhat_00001.1.el9eap.noarch.rpm SHA-256: 9b96190fcaa32a1fe79f95114b4be8d84060824d2612bf9de45ea9be80480b02 eap8-jose4j-0.9.6-2.redhat_00002.1.el9eap.noarch.rpm SHA-256: 7c80c1fe1247624ce677f988e6fc7a2109eb4995d81c70e0640ceb81f389987c eap8-netty-4.1.135-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: b2f5904638e588d94def03f03de6070b46748de1537ddde2dd1412355f952b44 eap8-netty-buffer-4.1.135-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 0809a9b5f356f4dba37add9a6ef5d9611dc58faebaf0b255b7e8c3fa2dc3c235 eap8-netty-codec-4.1.135-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: de305e1691d72bef04286de4f28f7d2e9883caeb13426a1f231836e40d1622f2 eap8-netty-codec-dns-4.1.135-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: fb9bab7086003d2b7bcae5b13e0d1b81acf775dee4390d7e954f06521f1349dd eap8-netty-codec-http-4.1.135-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 2e2df4e41006a76e4f857c6873132f02cbbe44ac3773b968c15d9a27a1ae4bc3 eap8-netty-codec-socks-4.1.135-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 0c1876cd8d18b103e207c731b538c541549a7d35d0c611a56b96a34b0166e8b9 eap8-netty-common-4.1.135-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 33825e94c996f85da09ecf3d489d511c7fa293d9bbfc443b36a317d64ea2466d eap8-netty-handler-4.1.135-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 63d690299000918e04b46c017165ef728d4df09a5025574d5807509f0a9410dc eap8-netty-handler-proxy-4.1.135-1.Final_redhat_00001.1.el9eap.noarch.rpm SHA-256: 020ea8b3115b88040cb9767986e30fa10c54f54481