Red Hat Product Errata RHSA-2026:33371 - Security Advisory Issued: 2026-06-30 Updated: 2026-06-30 RHSA-2026:33371 - Security Advisory Overview Updated Packages Synopsis Important: Red Hat JBoss Enterprise Application Platform 7.3.18 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.3.18 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.3.17, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.18 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): jose4j: From CVEorg collector (CVE-2024-29371) undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF (CVE-2025-12543) org.apache.cxf/cxf-core: Apache CXF: Denial of Service vulnerability with temporary files (CVE-2025-23184) undertow-core: Undertow MadeYouReset HTTP/2 DDoS Vulnerability (CVE-2025-9784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Affected Products JBoss Enterprise Application Platform 7.3 EUS 7.3 x86_64 Fixes BZ - 2339095 - CVE-2025-23184 org.apache.cxf: Apache CXF: Denial of Service vulnerability with temporary files BZ - 2392306 - CVE-2025-9784 undertow: Undertow MadeYouReset HTTP/2 DDoS Vulnerability BZ - 2408784 - CVE-2025-12543 undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF BZ - 2423194 - CVE-2024-29371 jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression JBEAP-31703 - Tracker bug for the EAP 7.3.18 release for RHEL-7 JBEAP-33004 - [7.3.z] Upgrade Jose4j from 0.9.6.redhat-00002 to 0.9.6.redhat-00003 CVEs CVE-2024-29371 CVE-2025-9784 CVE-2025-12543 CVE-2025-13465 CVE-2025-15284 CVE-2025-23184 CVE-2025-23368 CVE-2025-66412 CVE-2025-69873 CVE-2026-1002 CVE-2026-24842 References https://access.redhat.com/security/updates/classification/#important https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3 https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html/7.3.0_release_notes/index Note: More recent versions of these packages may be available. Click a package name for more details. JBoss Enterprise Application Platform 7.3 EUS 7.3 SRPM eap7-apache-cxf-3.4.10-4.SP2_redhat_00004.1.el7eap.src.rpm SHA-256: 691e952fc743b445dc92d044aec4a1a6e8b434851eb6c7af8e9a601ba5b9853d eap7-jboss-server-migration-1.7.2-23.Final_redhat_00025.1.el7eap.src.rpm SHA-256: 9b9c10befa76e9016720ef979f696ce82d7846bc4915206949dc770b9b9f472f eap7-undertow-2.0.41-8.SP9_redhat_00001.1.el7eap.src.rpm SHA-256: 218adf08da3e1f6a14f22928ededb27f3730187de71c8084da7c8c5a1606a6d0 eap7-wildfly-7.3.18-3.GA_redhat_00001.1.el7eap.src.rpm SHA-256: 0a36a0040e3014290c4f5ce5084c1b44987e642d3bbe4245c567f1c5bfe54d2f x86_64 eap7-apache-cxf-3.4.10-4.SP2_redhat_00004.1.el7eap.noarch.rpm SHA-256: 6fbd7975b1e72c34e99d8123c1a62328376fa8c294344933ae497c74ec509f46 eap7-apache-cxf-rt-3.4.10-4.SP2_redhat_00004.1.el7eap.noarch.rpm SHA-256: 0e0976ed5338e8f3a79e5837ae86e12762fe06a74a87be872c027281f6255766 eap7-apache-cxf-services-3.4.10-4.SP2_redhat_00004.1.el7eap.noarch.rpm SHA-256: 83707446f7ba015694eb07ba51cc06ad4039bb9a7cc92d4cd283073a0344267e eap7-apache-cxf-tools-3.4.10-4.SP2_redhat_00004.1.el7eap.noarch.rpm SHA-256: a1c00a5fcc42bf65325ec61afa2d0d054fcb63297be81ea9ca727b2f2d93a25b eap7-jboss-server-migration-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: e4315a33bbf1d6f84dfa2725fe481d4757c007fac735596e3008214ed4b767db eap7-jboss-server-migration-cli-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: cc1fdec8739644470e189933aa76ff163be301fd4b604947ff63d6b87a692e55 eap7-jboss-server-migration-core-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: a2eab65514be3efe6545ddaa213157887122792780241bfc61117266bcda2a69 eap7-jboss-server-migration-eap6.4-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: ee7cdf5df67116b43f2a054f20c2b8d1afa4e9211a0afe51a8d0466af9dc7c3f eap7-jboss-server-migration-eap6.4-to-eap7.3-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: fac1d979c3f7443bb32b4eff55adcb1602a494a2a1237b4f79b66ac2a9ce5605 eap7-jboss-server-migration-eap7.0-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: ec33cb4f0e07e93c8c45cc2e1c67b05f9446f18ec62e9227deb9750697141c6a eap7-jboss-server-migration-eap7.1-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: d8a108f5bd9d5e5c8044c8cbdd1c6e4bfd6898a90bd3d5f0063e14cd1bb53003 eap7-jboss-server-migration-eap7.2-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: d512d70055912933135bff54b25868d1de41757486bbf22090eaf3994c35d7a7 eap7-jboss-server-migration-eap7.2-to-eap7.3-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: c98560c67c22c935a056b5a14d8e6bce50a8701104e950ad519e409e97486f4d eap7-jboss-server-migration-eap7.3-server-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: a881eff88f7010039db7771da0998fa0f7b8d51fb256fd51f5be642b14e5d9c9 eap7-jboss-server-migration-wildfly10.0-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: adef253ad299fc60673c2b287a0f5953a8595efd397bd12c93390e0f878d60e9 eap7-jboss-server-migration-wildfly10.1-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: bf63dc56394d5d80bc64a70c953372a3259cb5d4ad87e99033db8d333e29cb9c eap7-jboss-server-migration-wildfly11.0-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: c39301dc3bd3ef8bfd337b3e49fbf3dbabc6b47eda05bbffb844dcf5ae3a9086 eap7-jboss-server-migration-wildfly12.0-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: 7c6f188ebcc3450c688a6704bf98dc41b07eb38839a10fa521b8f4c491a1c44b eap7-jboss-server-migration-wildfly13.0-server-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: 105136c5c6054a95315eda1f67b261bfe163bb45ba5038754d94e63e16718a57 eap7-jboss-server-migration-wildfly14.0-server-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: 38381eac444f3c8957ffab216724b0c6eb5c682fedf709de69c661c115ca4f7d eap7-jboss-server-migration-wildfly15.0-server-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: c35adcff2a83d840cbd9a8e876820c12bf475f747f1d4d3da402eaa32f9069ca eap7-jboss-server-migration-wildfly16.0-server-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: bbe5f1b9e36f6f86d9a7daed414498627cd53a262bed0edbe410cf3e5ebd32fb eap7-jboss-server-migration-wildfly17.0-server-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: d771c082fb732ede566b7069bc4cc79ce0174b6b12b22c96108d3b44d7c20172 eap7-jboss-server-migration-wildfly18.0-server-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: a7975fa74aa321d4a30edb267a2e5daadfe62e6a302865bb3cc5758f783b8ba9 eap7-jboss-server-migration-wildfly8.2-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: 6c61718d0825045617873ec24b6b36080b696e90c7c5c13cb2776a6f1620c8c7 eap7-jboss-server-migration-wildfly9.0-1.7.2-23.Final_redhat_00025.1.el7eap.noarch.rpm SHA-256: ba0577d0b5e8d2c8466e2cc8ebf792112b001d0761d60b4db15f586e2ee73be2 eap7-undertow-2.0.41-8.SP9_redhat_00001.1.el7eap.noarch.rpm SHA-256: ba33c2923719b9b119d55b8935e92210562d66c56dc6f57ca8dd9c0e7c7fcc2d eap7-wildfly-7.3.18-3.GA_redhat_00001.1.el7eap.noarch.rpm SHA-256: de8cfffab4821e3d9f292828ace8c324aa5cb8f8a8cf8d399ce8d8aac0328443 eap7-wildfly-java-jdk11-7.3.18-3.GA_redhat_00001.1.el7eap.noarch.rpm SHA-256: ff543b8603474ce7bfed134b22ca035a2891cfd6794ebe0affe3e52255e57bea eap7-wildfly-java-jdk8-7.3.18-3.GA_redhat_00001.1.el7eap.noarch.rpm SHA-256: b88ed556b3e35475f0350c09a4f30040d6276745faf247f8efdba3576d9161ca eap7-wildfly-javadocs-7.3.18-3.GA_redhat_00001.1.el7eap.noarch.rpm SHA-256: bef0d516d05628c023ca1b6b68ce6f9f4ce30627cefce64380929093ea0f24a5 eap7-wildfly-modules-7.3.18-3.GA_redhat_00001.1.el7eap.noarch.rpm SHA-256: 59fe563f42c46c25e1ffd54e700c0dc8b1d7df759bda0e5b0c4a23a63fe6cea6 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .