Red Hat Red Hat Fuse 7
78 CVEs affecting Red Hat Red Hat Fuse 7. Latest disclosed: 2026-10-16. Critical: 1, High: 48.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12543 | Critical | 9.6 | 2026-01-07 | A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly val… |
CVE-2026-85634 | High | 8.8 | 2026-10-15 | A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server… |
CVE-2026-28369 | High | 8.7 | 2026-03-27 | A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the r… |
CVE-2026-28368 | High | 8.7 | 2026-03-27 | A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by… |
CVE-2026-28367 | High | 8.7 | 2026-03-27 | A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request s… |
CVE-2023-6267 | High | 8.6 | 2024-01-25 | A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being proc… |
CVE-2026-0603 | High | 8.3 | 2026-01-23 | A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, u… |
CVE-2026-93569 | High | 8.2 | 2026-09-18 | A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request… |
CVE-2026-84218 | High | 8.1 | 2026-09-01 | A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist i… |
CVE-2025-23368 | High | 8.1 | 2025-03-04 | A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within… |
CVE-2024-1132 | High | 8.1 | 2024-04-17 | A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious requ… |
CVE-2024-45497 | High | 7.6 | 2024-12-31 | A flaw was found in the OpenShift build process, where the docker-build container is configured with a hostPath volume mount that maps the node's /var/lib/kube… |
CVE-2026-94449 | High | 7.5 | 2026-09-21 | A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. T… |
CVE-2026-93576 | High | 7.5 | 2026-09-18 | A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-nam… |
CVE-2026-93568 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's… |
CVE-2026-93567 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONN… |
CVE-2026-93565 | High | 7.5 | 2026-09-18 | A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming… |
CVE-2026-93564 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted P… |
CVE-2026-93558 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to… |
CVE-2026-93560 | High | 7.5 | 2026-09-18 | A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum inte… |