wildfly__wildfly_CVE-2018-1047_11-0-0-Final

WildFly Application Server http://wildfly.org Fast Startup Small Footprint Modular Design Unified Configuration and Management And of course Java EE7! Building Prerequisites: JDK 8 or newer - check java -version Maven 3.3.1 or newer - check mvn -v On nix systems, make sure that the maximum number...

wildPwn

wildPwn - WildFly Exploitation Tool It is a tool for WildFly. Tool can be used to brute force or shell deploy. wildPwn.war contains modified Laudanum Shell. userList.txt contains common usernames and passList.txt contains common passwords. Usage Bruteforce python wildPwn.py -m brute --target -use...

CLEANSTART-2026-WN90580 flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature

Security vulnerability affects the apache-hive package. A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature...

CLEANSTART-2026-NF19276 Improper certificate validation in Apache MINA SSHD (server-side)

Security vulnerability affects the wildfly package. Improper certificate validation in Apache MINA SSHD server-side...

CVE-2025-12543-Fix-for-Wildfly

WildFly 11.0.0.Final Base Image — CVE-2025-12543 Patch Overview This repository provides a Docker base image built on WildFly 11.0.0.Final with a backported fix for CVE-2025-12543 , a critical Host header validation vulnerability in Undertow. The image is intended to be provided to colleagues as ...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: scala, keycloak, tez, sonarqube, apache-tika, trino, spark, keycloak-config-cli, infinispan, spdx-tools-java, wildfly, apache-nifi, cass-config-builder, akhq, apache-nifi-registry, druid, flyway, apicurio-registry, opensearch, dependency-track, gradle, logstash,...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: scala, keycloak, tez, sonarqube, apache-tika, trino, spark, keycloak-config-cli, infinispan, spdx-tools-java, wildfly, apache-nifi, cass-config-builder, akhq, apache-nifi-registry, druid, flyway, apicurio-registry, opensearch, dependency-track, gradle, logstash,...

GHSA-GX83-3VF8-GH7J vulnerabilities

Vulnerabilities for packages: scala, thingsboard, tez, sonarqube, apache-tika, trino, ruby3.3-jrjackson, zookeeper, spark, kserve-modelmesh, keycloak-config-cli, zipkin, nextflow, infinispan, jenkins-plugin-manager, apache-pulsar, ruby3.2-jrjackson, spdx-tools-java, wildfly, wavefront-proxy, akhq...

GHSA-Q4XH-88C3-WMH7 vulnerabilities

Vulnerabilities for packages: scala, thingsboard, tez, sonarqube, apache-tika, trino, ruby3.3-jrjackson, zookeeper, spark, kserve-modelmesh, keycloak-config-cli, zipkin, nextflow, infinispan, jenkins-plugin-manager, apache-pulsar, ruby3.2-jrjackson, spdx-tools-java, wildfly, wavefront-proxy, akhq...

CVE-2026-83557 vulnerabilities

Vulnerabilities for packages: scala, thingsboard, tez, sonarqube, apache-tika, trino, ruby3.3-jrjackson, zookeeper, spark, kserve-modelmesh, keycloak-config-cli, zipkin, nextflow, infinispan, jenkins-plugin-manager, apache-pulsar, ruby3.2-jrjackson, spdx-tools-java, wildfly, wavefront-proxy, akhq...

CVE-2026-19032 vulnerabilities

Vulnerabilities for packages: scala, thingsboard, tez, sonarqube, apache-tika, trino, ruby3.3-jrjackson, zookeeper, spark, kserve-modelmesh, keycloak-config-cli, zipkin, nextflow, infinispan, jenkins-plugin-manager, apache-pulsar, ruby3.2-jrjackson, spdx-tools-java, wildfly, wavefront-proxy, akhq...

CVE-2026-68497 vulnerabilities

Vulnerabilities for packages: scala, thingsboard, tez, sonarqube, apache-tika, trino, ruby3.3-jrjackson, zookeeper, spark, kserve-modelmesh, keycloak-config-cli, zipkin, nextflow, infinispan, jenkins-plugin-manager, apache-pulsar, ruby3.2-jrjackson, spdx-tools-java, wildfly, wavefront-proxy, akhq...

GHSA-WJGM-6HV5-3CVF vulnerabilities

Vulnerabilities for packages: scala, thingsboard, tez, sonarqube, apache-tika, trino, ruby3.3-jrjackson, zookeeper, spark, kserve-modelmesh, keycloak-config-cli, zipkin, nextflow, infinispan, jenkins-plugin-manager, apache-pulsar, ruby3.2-jrjackson, spdx-tools-java, wildfly, wavefront-proxy, akhq...

CLEANSTART-2026-KS26010 flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Acces...

Security vulnerability affects the wildfly package. A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true...

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

org.wildfly.security/wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER Payload

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...