[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdfa2bEbpKhD-eN0-U0bzZoDKXqHwZcxk4l2mkXwVQbs":3,"g5a-ex:redhat\u002Fjboss_enterprise_application_platform_expansion_pack@*":97,"g5a-family:redhat\u002Fjboss_enterprise_application_platform_expansion_pack":99},{"success":4,"data":5},true,{"product":6,"versions":14,"topVulnerabilitiesByEpss":15,"kevVulnerabilities":74,"seoMetadata":75,"meta":94},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":9,"lastCveUpdate":11,"versions":12,"description":13},"redhat","jboss_enterprise_application_platform_expansion_pack",0,10,"2026-03-27",[],"Jboss Enterprise Application Platform Expansion Pack by Redhat is a technology product and 10 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[],[16,25,30,35,42,47,50,55,62,68],{"cveId":17,"description":18,"publishedDate":19,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":24},"CVE-2025-9784","A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).","2025-09-02",7.5,"v3.1","High",false,0.02325,{"cveId":26,"description":27,"publishedDate":28,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":29},"CVE-2023-1108","A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.","2023-09-14",0.01771,{"cveId":31,"description":32,"publishedDate":33,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":34},"CVE-2022-0853","A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability.","2022-03-11",0.01452,{"cveId":36,"description":37,"publishedDate":38,"cvssScore":39,"cvssVersion":21,"severity":40,"isKev":23,"epssScore":41},"CVE-2025-12543","A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.","2026-01-07",9.6,"Critical",0.01333,{"cveId":43,"description":44,"publishedDate":11,"cvssScore":45,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":46},"CVE-2026-28369","A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.",8.7,0.00886,{"cveId":48,"description":49,"publishedDate":11,"cvssScore":45,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":46},"CVE-2026-28368","A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.",{"cveId":51,"description":52,"publishedDate":53,"cvssScore":20,"cvssVersion":21,"severity":22,"isKev":23,"epssScore":54},"CVE-2022-1278","A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.","2022-09-13",0.00861,{"cveId":56,"description":57,"publishedDate":58,"cvssScore":59,"cvssVersion":21,"severity":60,"isKev":23,"epssScore":61},"CVE-2021-3642","A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.","2021-08-05",5.3,"Medium",0.00846,{"cveId":63,"description":64,"publishedDate":65,"cvssScore":66,"cvssVersion":21,"severity":60,"isKev":23,"epssScore":67},"CVE-2021-20250","A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.","2021-05-13",4.3,0.00743,{"cveId":69,"description":70,"publishedDate":71,"cvssScore":72,"cvssVersion":21,"severity":60,"isKev":23,"epssScore":73},"CVE-2023-4503","An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.","2024-02-06",6.8,0.0072,[],{"title":76,"metaDescription":77,"keywords":78,"structuredData":79},"Jboss Enterprise Application Platform Expansion Pack by Redhat - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Jboss Enterprise Application Platform Expansion Pack by Redhat with 10 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Jboss Enterprise Application Platform Expansion Pack vulnerabilities, Jboss Enterprise Application Platform Expansion Pack security, Jboss Enterprise Application Platform Expansion Pack CVE, Redhat Jboss Enterprise Application Platform Expansion Pack, Jboss Enterprise Application Platform Expansion Pack threat intelligence, Redhat security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":80,"@type":81,"name":82,"description":77,"url":83,"manufacturer":84,"applicationCategory":88,"softwareVersion":89,"mainEntity":90},"https:\u002F\u002Fschema.org","SoftwareApplication","Jboss Enterprise Application Platform Expansion Pack","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fredhat\u002Fjboss_enterprise_application_platform_expansion_pack",{"@type":85,"name":86,"url":87},"Organization","Redhat","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fredhat","Security Software","Multiple versions",{"@type":91,"name":92,"description":93,"vulnerabilityCount":10,"dateModified":11},"SecurityVulnerability","Jboss Enterprise Application Platform Expansion Pack Security Vulnerabilities","Security vulnerabilities affecting Jboss Enterprise Application Platform Expansion Pack by Redhat",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":9,"lastUpdated":11,"generatedAt":95,"apiVersion":96},"2026-10-17T14:58:16.760Z","3.0",{"rows":98,"total":9,"capped":23,"failed":9},[],[]]