RHSA-2026:92057HighCVSS 8.6

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.9 security update

Published
October 28, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (5)

CVE-2026-64958 →CVE-2026-65432 →CVE-2026-65583 →CVE-2026-57819 →CVE-2026-59903 →

📋 Description

CVE-2026-57819 — Apache CXF: Apache CXF: Denial of Service via uncontrolled form parameters CVE-2026-59903 — io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite CVE-2026-64958 — org.apache.cxf/cxf: Apache CXF: Denial of service via many attachment headers CVE-2026-65432 — Apache CXF: Apache CXF: XML External Entity (XXE) vulnerability via WSDL/XSD import parsing CVE-2026-65583 — org.apache.cxf/cxf: Apache CXF: Authentication Bypass via Crafted OIDC Self-Issued ID Tokens

🎯 Affected products123

  • Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-apache-cxf-0:4.1.8-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-apache-cxf-0:4.1.8-1.redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-apache-cxf-rt-0:4.1.8-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-apache-cxf-services-0:4.1.8-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-apache-cxf-tools-0:4.1.8-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-apache-sshd-0:2.19.0-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-apache-sshd-0:2.19.0-1.redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-codemodel-0:4.0.8-2.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-eap-product-conf-parent-0:801.9.0-2.GA_redhat_00003.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-eap-product-conf-parent-0:801.9.0-2.GA_redhat_00003.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-eap-product-conf-wildfly-ee-feature-pack-0:801.9.0-2.GA_redhat_00003.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-hal-console-0:3.7.22-2.Final_redhat_00002.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-hal-console-0:3.7.22-2.Final_redhat_00002.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-hibernate-0:6.6.56-2.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-hibernate-0:6.6.56-2.Final_redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-hibernate-core-0:6.6.56-2.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-hibernate-envers-0:6.6.56-2.Final_redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-jackson-annotations-0:2.18.11-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-jackson-annotations-0:2.18.11-1.redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-jackson-core-0:2.18.11-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-jackson-core-0:2.18.11-1.redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-jackson-databind-0:2.18.11-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-jackson-databind-0:2.18.11-1.redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-jackson-dataformat-yaml-0:2.18.11-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-jackson-dataformats-text-0:2.18.11-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-jackson-dataformats-text-0:2.18.11-1.redhat_00001.1.el8eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-jackson-datatype-jdk8-0:2.18.10-2.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-jackson-datatype-jsr310-0:2.18.10-2.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • eap8-jackson-jaxrs-base-0:2.18.10-1.redhat_00001.1.el8eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 8
  • +93 more not shown

✅ Remediation

Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Update Apache CXF to the latest version that includes the fix. Configure form parameter limits in application settings to prevent resource exhaustion attacks. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Update Apache CXF to a version that includes the fix. Disable DTD processing and external entity resolution in XML parsers. Avoid processing untrusted WSDL/XSD imports. Workaround: Keep the default behavior of the Apache CXF OIDC relying-party token validator: self-issued ID tokens are not accepted by default, so deployments that have not enabled their acceptance are not exposed to this authentication bypass. Deployments that have enabled acceptance of self-issued ID tokens can mitigate the issue by disabling that configuration. As a longer-term resolution, upgrading to an upstream Apache CXF version containing the fix (4.2.3, 4.1.8, or 3.6.12, as recommended in the Apache advisory) is advised.

🔗 References (16)