GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: trino, strimzi-kafka-operator, akhq, logstash, spark, gradle, apache-nifi-registry, apache-tika, dependency-track, keycloak, apache-nifi, infinispan, druid, keycloak-config-cli, wildfly, apicurio-registry, flyway, tez, opensearch, spdx-tools-java, scala,...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: trino, strimzi-kafka-operator, akhq, logstash, spark, gradle, apache-nifi-registry, apache-tika, dependency-track, keycloak, apache-nifi, infinispan, druid, keycloak-config-cli, wildfly, apicurio-registry, flyway, tez, opensearch, spdx-tools-java, scala,...

wildfly__wildfly_CVE-2018-1047_11-0-0-Final

WildFly 애플리케이션 서버 http://wildfly.org 빠른 시작 작은 설치 공간 모듈식 설계 통합 구성 및 관리 그리고 물론 Java EE7! 빌드 사전 요구 사항: JDK 8 이상 - java -version 확인 Maven 3.3.1 이상 - mvn -v 확인 nix 시스템에서는 빌드를 실행하는 사용자의 최대 열린 파일 수가 4096 이상인지 확인하십시오 ulimit -n 확인 또는 사용자가 실행 중인 다른 I/O 집약적 프로세스에 따라 더 많은 값을 설정하십시오. 자체 Maven 설치로 빌드하려면: mvn...

wildPwn

wildPwn - WildFly Exploitation Tool It is a tool for WildFly. Tool can be used to brute force or shell deploy. wildPwn.war contains modified Laudanum Shell. userList.txt contains common usernames and passList.txt contains common passwords. Usage Bruteforce python wildPwn.py -m brute --target -use...

CVE-2025-12543-Fix-for-Wildfly

WildFly 11.0.0.Final 기본 이미지 — CVE-2025-12543 패치 개요 이 저장소는 CVE-2025-12543Undertow의 치명적인 Host 헤더 검증 취약점에 대한 백포트 수정 사항이 포함된 WildFly 11.0.0.Final 기반의 Docker 기본 이미지를 제공합니다. 이 이미지는 동료들에게 기본 이미지로 제공하기 위해 제작되었습니다. 동료들은 자체 .war 애플리케이션과 standalone.xml을 이 이미지 위에 배포할 수 있습니다. CVE-2025-12543 요약 필드| 세부 정보 ---|-...

CVE-2026-83557 vulnerabilities

Vulnerabilities for packages: kafka, jenkins-plugin-manager, trino, strimzi-kafka-operator, akhq, logstash, gradle, apache-tika, solr, strimzi-kafka-oauth, ruby3.2-jrjackson, thingsboard, confluent-kafka, neo4j, dependency-track, infinispan, druid, keycloak-config-cli, wildfly, apicurio-registry,...

GHSA-WJGM-6HV5-3CVF vulnerabilities

Vulnerabilities for packages: kafka, jenkins-plugin-manager, trino, strimzi-kafka-operator, akhq, logstash, gradle, apache-tika, solr, strimzi-kafka-oauth, ruby3.2-jrjackson, thingsboard, confluent-kafka, neo4j, dependency-track, infinispan, druid, keycloak-config-cli, wildfly, apicurio-registry,...

CVE-2026-19032 vulnerabilities

Vulnerabilities for packages: kafka, jenkins-plugin-manager, trino, strimzi-kafka-operator, akhq, logstash, gradle, apache-tika, solr, strimzi-kafka-oauth, ruby3.2-jrjackson, thingsboard, confluent-kafka, neo4j, dependency-track, infinispan, druid, keycloak-config-cli, wildfly, apicurio-registry,...

CVE-2026-68497 vulnerabilities

Vulnerabilities for packages: kafka, jenkins-plugin-manager, trino, strimzi-kafka-operator, akhq, logstash, gradle, apache-tika, solr, strimzi-kafka-oauth, ruby3.2-jrjackson, thingsboard, confluent-kafka, neo4j, dependency-track, infinispan, druid, keycloak-config-cli, wildfly, apicurio-registry,...

GHSA-GX83-3VF8-GH7J vulnerabilities

Vulnerabilities for packages: kafka, jenkins-plugin-manager, trino, strimzi-kafka-operator, akhq, logstash, gradle, apache-tika, solr, strimzi-kafka-oauth, ruby3.2-jrjackson, thingsboard, confluent-kafka, neo4j, dependency-track, infinispan, druid, keycloak-config-cli, wildfly, apicurio-registry,...

GHSA-Q4XH-88C3-WMH7 vulnerabilities

Vulnerabilities for packages: kafka, jenkins-plugin-manager, trino, strimzi-kafka-operator, akhq, logstash, gradle, apache-tika, solr, strimzi-kafka-oauth, ruby3.2-jrjackson, thingsboard, confluent-kafka, neo4j, dependency-track, infinispan, druid, keycloak-config-cli, wildfly, apicurio-registry,...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

wildfly: wildfly-iiop: wildfly-jacorb: Wildfly: Pre-auth denial of service on the IIOP listener

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

org.wildfly.security/wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include

A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...