CVE-2021-3629

CVE-2021-3629 affects Undertow. The vulnerability is a flow-control handling issue over HTTP/2 that may cause overhead or a denial of service, impacting availability. Affected versions are Undertow prior to 2.0.40.Final and prior to 2.2.11.Final. Remediation: upgrade to Undertow 2.0.40.Final or 2...

CVE-2021-3717

CVE-2021-3717 affects WildFly; root cause is an incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration, potentially allowing access to all local users. The issue impacts wildfly-core versions prior to 17.0 and has confidentiality, integrity, and availability implicatio...

CVE-2023-4061

CVE-2023-4061 concerns WildFly Core. Affected component: the HAL Interface in WildFly Core, where a management user could use resolve-expression to read possible sensitive information from the system, enabling exposure of system properties to an unauthorized actor. The vulnerability is mitigated ...

CVE-2025-23368

CVE-2025-23368 relates to the Wildfly Elytron integration exposing a brute-force risk for CLI authentication. Red Hat’s advisory RHSA-2026:18059 (and CVE-2025-23368‑specific RHSA-2026:18059-CVE-2025-23368) fixes this in Red Hat JBoss Enterprise Application Platform 8.1.6 and WildFly Core updates....

CVE-2019-14838

The CVE-2019-14838 entry concerns WildFly (wildfly-core) prior to 7.2.5.GA, where Management users bearing Monitor, Auditor, or Deployer roles could modify the server’s runtime state due to an authorization misconfiguration. The issue is tied to WildFly/JBoss components, with multiple advisories ...

CVE-2018-10862

WildFly Core before 6.0.0.Alpha3 is vulnerable due to insufficient validation of file paths in .war archives, enabling crafted archives to overwrite arbitrary files (Zip Slip). The issue is confirmed by linked advisories (GHSA-W8R2-5J8X-X8J6) and Red Hat security notes referencing CVE-2018-10862....