Red Hat Vulnerabilities and Affected Products
Vulnerabilities associated with JBoss Core Services for RHEL 8.
Products
Clear product- Red Hat Enterprise Linux 91,515 vulnerabilities
- Red Hat Enterprise Linux 81,496 vulnerabilities
- Red Hat Enterprise Linux 71,145 vulnerabilities
- Red Hat Enterprise Linux 101,132 vulnerabilities
- Red Hat Enterprise Linux 61,113 vulnerabilities
- Red Hat OpenShift Container Platform 4430 vulnerabilities
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support402 vulnerabilities
- Red Hat Enterprise Linux 9.6 Extended Update Support386 vulnerabilities
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support377 vulnerabilities
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions367 vulnerabilities
- Red Hat Enterprise Linux 10.0 Extended Update Support361 vulnerabilities
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions356 vulnerabilities
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service353 vulnerabilities
- Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On325 vulnerabilities
- Red Hat Enterprise Linux 7 Extended Lifecycle Support319 vulnerabilities
- Red Hat OpenShift AI (RHOAI)302 vulnerabilities
- Red Hat Enterprise Linux 9.4 Extended Update Support297 vulnerabilities
- Red Hat Hardened Images277 vulnerabilities
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions270 vulnerabilities
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service253 vulnerabilities
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions253 vulnerabilities
- Red Hat JBoss Enterprise Application Platform Expansion Pack236 vulnerabilities
- Red Hat Enterprise Linux 8.2 Advanced Update Support213 vulnerabilities
- Red Hat Single Sign-On 7177 vulnerabilities
- Red Hat Fuse 7175 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-49975HIGH | Apache HTTP Server: mod_http2 denial of serviceMemory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67. | CVSS7.5v3.1 | EPSS28% | PoCs11 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-28780CRITICAL | Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_ajp and cause it to write 4 attacker controlled bytes after the end of a heap based buffer. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue. | CVSS9.8v3.1 | EPSS1.38% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-27135HIGH | nghttp2 Denial of service: Assertion failure due to the missing state validationnghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data af… CWE-617Mar 18, 2026 | CVSS7.5v3.1 | EPSS0.775% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-6710MEDIUM | Mod_cluster/mod_proxy_cluster: stored cross site scriptingA flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page. CWE-79Dec 12, 2023 | CVSS5.4v3.1 | EPSS2.24% | PoCs3 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |