A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Jul 8, 2026 | Jul 7, 2026 |
| Redhat_linux | — | Upgrade eap8-opensaml-saml-implUpgrade eap8-wildfly-modulesUpgrade eap8-bouncycastle-pgUpgrade eap8-wildfly-clustering-server-localUpgrade eap8-antlr4-runtimeUpgrade eap8-aws-java-sdk-regionsUpgrade eap8-jakarta-interceptor-apiUpgrade eap8-netty-codec-socksUpgrade eap8-resteasy-clientUpgrade eap8-jakarta-securityUpgrade eap8-aws-java-sdk-annotationsUpgrade eap8-hal-consoleUpgrade eap8-jbossws-common-toolsUpgrade eap8-joda-timeUpgrade eap8-jakarta-enterprise-concurrentUpgrade eap8-activemq-artemis-jakarta-clientUpgrade eap8-txw2Upgrade eap8-activemq-artemis-hornetq-protocolUpgrade eap8-javaee-security-soteriaUpgrade eap8-xml-securityUpgrade eap8-aws-java-sdk-sdk-coreUpgrade eap8-hornetq-core-clientUpgrade eap8-jakarta-client-resteasyUpgrade eap8-commons-logging-jboss-loggingUpgrade eap8-undertow-jastowUpgrade eap8-yassonUpgrade eap8-ws-commons-XmlSchemaUpgrade eap8-wildfly-clustering-cache-infinispan-remoteUpgrade eap8-wildfly-clustering-server-jgroupsUpgrade eap8-opensaml-xmlsec-apiUpgrade eap8-ironjacamar-core-implUpgrade eap8-guavaUpgrade eap8-wildfly-clustering-session-spec-spiUpgrade eap8-shibboleth-java-supportUpgrade eap8-angus-mailUpgrade eap8-jboss-metadata-commonUpgrade eap8-jackson-datatype-jdk8Upgrade eap8-cxf-xjc-runtimeUpgrade eap8-jberet-coreUpgrade eap8-jsonb-specUpgrade eap8-ironjacamar-deployers-commonUpgrade eap8-lucene-queryparserUpgrade eap8-elasticsearch-rest-client-snifferUpgrade eap8-guava-librariesUpgrade eap8-infinispan-client-hotrodUpgrade eap8-narayana-restat-bridgeUpgrade eap8-agroal-apiUpgrade eap8-cryptacularUpgrade eap8-lucene-solrUpgrade eap8-wildfly-http-transaction-clientUpgrade eap8-aws-java-sdk-aws-xml-protocolUpgrade eap8-jackson-databindUpgrade eap8-cxf-xjc-tsUpgrade eap8-netty-resolverUpgrade eap8-narayanaUpgrade eap8-undertowUpgrade eap8-jgroups-kubernetesUpgrade eap8-weld-core-implUpgrade eap8-jboss-ejb-clientUpgrade eap8-jboss-weld-api-weld-spiUpgrade eap8-jctoolsUpgrade eap8-wildfly-clustering-server-infinispanUpgrade eap8-eventstreamUpgrade eap8-jakarta-annotation-apiUpgrade eap8-aws-java-sdk-crt-coreUpgrade eap8-jakarta-batch-apiUpgrade eap8-activemq-artemis-cliUpgrade eap8-jasyptUpgrade eap8-wildfly-http-naming-clientUpgrade eap8-netty-transportUpgrade eap8-runtimeUpgrade eap8-jakarta-resource-apiUpgrade eap8-aws-java-sdk-checksumsUpgrade eap8-narayana-jts-integrationUpgrade eap8-gsonUpgrade eap8-jakarta-transaction-apiUpgrade eap8-activemq-artemis-jakarta-raUpgrade eap8-javaee-security-soteria-enterpriseUpgrade eap8-netty-codec-dnsUpgrade eap8-jboss-openjdk-orbUpgrade eap8-wildfly-openssl-javaUpgrade eap8-jakarta-servlet-jsp-jstl-apiUpgrade eap8-wildflyUpgrade eap8-wildfly-commonUpgrade eap8-aws-java-sdk-retriesUpgrade eap8-caffeineUpgrade eap8-jboss-remoting-jmxUpgrade eap8-jboss-weld-api-weld-apiUpgrade eap8-jboss-modulesUpgrade eap8-objectweb-asmUpgrade eap8-jackson-dataformats-textUpgrade eap8-jackson-jaxrs-json-providerUpgrade eap8-jboss-metadata-appclientUpgrade eap8-opensaml-xacml-saml-apiUpgrade eap8-jakarta-ejb-apiUpgrade eap8-jboss-saaj-api_3.0_specUpgrade eap8-istack-commons-toolsUpgrade eap8-weld-ejbUpgrade eap8-jbossws-cxfUpgrade eap8-resteasy-coreUpgrade eap8-resteasy-extensionsUpgrade eap8-slf4j-apiUpgrade eap8-vdx-coreUpgrade eap8-weld-core-jsfUpgrade eap8-ironjacamar-common-spiUpgrade eap8-lucene-coreUpgrade eap8-wildfly-clustering-session-cacheUpgrade eap8-jansiUpgrade eap8-eclipse-jgitUpgrade eap8-narayana-jts-idljUpgrade eap8-neethiUpgrade eap8-apache-cxfUpgrade eap8-infinispan-hibernate-cache-v62Upgrade eap8-jackson-module-jakarta-xmlbind-annotationsUpgrade eap8-apache-commons-ioUpgrade eap8-guava-failureaccessUpgrade eap8-bouncycastle-pkixUpgrade eap8-jakarta-mailUpgrade eap8-jakarta-authentication-apiUpgrade eap8-jaxb-jxcUpgrade eap8-resteasy-json-p-providerUpgrade eap8-resteasy-validator-providerUpgrade eap8-wildfly-clustering-marshalling-jbossUpgrade eap8-resteasy-core-spiUpgrade eap8-jboss-marshallingUpgrade eap8-jboss-remotingUpgrade eap8-log4j2-jboss-logmanagerUpgrade eap8-weld-jtaUpgrade eap8-wildfly-clustering-cache-spiUpgrade eap8-narayana-jbosstxbridgeUpgrade eap8-lucene-analysis-commonUpgrade eap8-wss4j-ws-security-policy-staxUpgrade eap8-nettyUpgrade eap8-aesh-readlineUpgrade eap8-saaj-implUpgrade eap8-jandexUpgrade eap8-activemq-artemis-dtoUpgrade eap8-activemq-artemis-selectorUpgrade eap8-jackson-modules-java8Upgrade eap8-jakarta-security-enterprise-apiUpgrade eap8-jackson-datatype-jsr310Upgrade eap8-jboss-metadata-earUpgrade eap8-hibernate-search-mapper-pojo-baseUpgrade eap8-jboss-metadata-webUpgrade eap8-jboss-cert-helperUpgrade eap8-infinispan-remote-query-clientUpgrade eap8-jboss-weld-apiUpgrade eap8-netty-transport-native-epoll-debuginfoUpgrade eap8-opensamlUpgrade eap8-protoparserUpgrade eap8-jberetUpgrade eap8-elasticsearch-rest-clientUpgrade eap8-infinispan-clustered-lockUpgrade eap8-snakeyamlUpgrade eap8-opensaml-security-apiUpgrade eap8-vdx-wildflyUpgrade eap8-jbossws-spiUpgrade eap8-resteasy-cdiUpgrade eap8-ironjacamar-core-apiUpgrade eap8-jakarta-websocket-apiUpgrade eap8-jaxbintrosUpgrade eap8-jackson-annotationsUpgrade eap8-eap-product-conf-wildfly-ee-feature-packUpgrade eap8-fastinfosetUpgrade eap8-aws-java-sdk-retries-spiUpgrade eap8-hibernate-enversUpgrade eap8-antlr4Upgrade eap8-aws-java-sdk-profilesUpgrade eap8-infinispan-clustered-counterUpgrade eap8-wss4j-ws-security-staxUpgrade eap8-netty-xnio-transportUpgrade eap8-jboss-metadata-ejbUpgrade eap8-resteasy-jackson2-providerUpgrade eap8-jakarta-jsonUpgrade eap8-apache-cxf-rtUpgrade eap8-activemq-artemis-core-clientUpgrade eap8-bouncycastleUpgrade eap8-hibernate-search-mapper-ormUpgrade eap8-wildfly-naming-clientUpgrade eap8-woodstox-coreUpgrade eap8-slf4j-jboss-logmanagerUpgrade eap8-activemq-artemis-journalUpgrade eap8-infinispan-cdi-remoteUpgrade eap8-wildfly-openssl-el10-x86_64Upgrade eap8-activemq-artemis-nativeUpgrade eap8-apache-commons-codecUpgrade eap8-resilience4jUpgrade eap8-activemq-artemis-serverUpgrade eap8-aws-java-sdk-apache-clientUpgrade eap8-narayana-restat-apiUpgrade eap8-stax2-apiUpgrade eap8-asyncutilUpgrade eap8-fge-msg-simpleUpgrade eap8-apache-cxf-servicesUpgrade eap8-aws-java-sdk-arnsUpgrade eap8-aws-java-sdk-identity-spiUpgrade eap8-staxmapperUpgrade eap8-ironjacamarUpgrade eap8-aws-java-sdk-aws-query-protocolUpgrade eap8-aws-java-sdk-checksums-spiUpgrade eap8-hibernate-commons-annotationsUpgrade eap8-httpcomponents-coreUpgrade eap8-aws-java-sdk-json-utilsUpgrade eap8-jakarta-ws-rs-apiUpgrade eap8-infinispan-cachestore-jdbc-commonUpgrade eap8-javapackages-toolsUpgrade eap8-javaee-jpa-specUpgrade eap8-jaxb-xjcUpgrade eap8-jakarta-enterprise-concurrent-apiUpgrade eap8-netty-codec-httpUpgrade eap8-jboss-classfilewriterUpgrade eap8-jboss-dmrUpgrade eap8-jboss-aeshUpgrade eap8-wss4j-ws-security-domUpgrade eap8-apache-commons-cliUpgrade eap8-wildfly-clustering-cache-infinispan-commonUpgrade eap8-wildfly-clustering-marshalling-spiUpgrade eap8-jboss-mscUpgrade eap8-wildfly-clustering-session-infinispan-embeddedUpgrade eap8-wildfly-javadocsUpgrade eap8-resteasy-jaxb-providerUpgrade eap8-bouncycastle-provUpgrade eap8-ironjacamar-common-apiUpgrade eap8-infinispan-cdi-commonUpgrade eap8-aws-java-sdk-metrics-spiUpgrade eap8-installation-manager-apiUpgrade eap8-jakarta-authorizationUpgrade eap8-opensaml-soap-apiUpgrade eap8-aws-java-sdk-protocol-coreUpgrade eap8-apache-commons-langUpgrade eap8Upgrade eap8-hornetq-commonsUpgrade eap8-jboss-transaction-spiUpgrade eap8-resteasyUpgrade eap8-jakarta-authenticationUpgrade eap8-parssonUpgrade eap8-jakarta-enterprise-cdi-apiUpgrade eap8-jakarta-authorization-apiUpgrade eap8-eap-product-conf-parentUpgrade eap8-elasticsearchUpgrade eap8-ironjacamar-common-implUpgrade eap8-jboss-marshalling-riverUpgrade eap8-jbossws-apiUpgrade eap8-jackson-jaxrs-baseUpgrade eap8-protostreamUpgrade eap8-jboss-stdioUpgrade eap8-aws-java-sdk-utilsUpgrade eap8-activemq-artemis-jdbc-storeUpgrade eap8-aws-java-sdk-s3Upgrade eap8-wildfly-elytronUpgrade eap8-wildfly-clustering-cache-infinispan-embeddedUpgrade eap8-velocityUpgrade eap8-agroal-narayanaUpgrade eap8-cxf-xjc-booleanUpgrade eap8-hibernate-search-backend-elasticsearchUpgrade eap8-jboss-logmanagerUpgrade eap8-log4jUpgrade eap8-infinispan-cdi-embeddedUpgrade eap8-wildfly-opensslUpgrade eap8-narayana-jbossxtsUpgrade eap8-jackson-coreutilsUpgrade eap8-cxf-xjc-bug986Upgrade eap8-jakarta-client-webservicesUpgrade eap8-jul-to-slf4j-stubUpgrade eap8-jakarta-enterprise-lang-modelUpgrade eap8-opensaml-xacml-implUpgrade eap8-sun-istack-commonsUpgrade eap8-pem-keystoreUpgrade eap8-resteasy-client-apiUpgrade eap8-angus-activationUpgrade eap8-aws-java-sdk-authUpgrade eap8-activemq-artemis-jakarta-service-extensionsUpgrade eap8-jcip-annotationsUpgrade eap8-infinispan-cachestore-remoteUpgrade eap8-aws-java-sdk-http-auth-awsUpgrade eap8-netty-transport-native-epollUpgrade eap8-artemis-nativeUpgrade eap8-ironjacamar-jdbcUpgrade eap8-aws-java-sdk-http-client-spiUpgrade eap8-jboss-metadataUpgrade eap8-reactivex-rxjavaUpgrade eap8-jbossws-jaxws-undertow-httpspiUpgrade eap8-relaxng-datatypeUpgrade eap8-netty-resolver-dnsUpgrade eap8-jboss-invocationUpgrade eap8-opensaml-xacml-saml-implUpgrade eap8-jbossws-commonUpgrade eap8-javaewahUpgrade eap8-jboss-el-api_5.0_specUpgrade eap8-jboss-ejb3-ext-apiUpgrade eap8-infinispan-query-dslUpgrade eap8-jakarta-servlet-apiUpgrade eap8-infinispan-queryUpgrade eap8-h2databaseUpgrade eap8-gnu-getoptUpgrade eap8-bouncycastle-utilUpgrade eap8-apache-mime4jUpgrade eap8-javapackages-filesystemUpgrade eap8-ironjacamar-validatorUpgrade eap8-resteasy-multipart-providerUpgrade eap8-stax-exUpgrade eap8-reactive-streamsUpgrade eap8-infinispan-hibernate-cache-spiUpgrade eap8-infinispan-coreUpgrade eap8-fge-btfUpgrade eap8-narayana-restat-utilUpgrade eap8-agroalUpgrade eap8-infinispan-hibernate-cache-commonsUpgrade eap8-resteasy-tracing-apiUpgrade eap8-wildfly-http-ejb-clientUpgrade eap8-wsdl4jUpgrade eap8-wildfly-transaction-clientUpgrade eap8-wildfly-java-jdk21Upgrade eap8-wildfly-elytron-eeUpgrade eap8-wildfly-clustering-marshalling-protostreamUpgrade eap8-slf4jUpgrade eap8-plexus-utilsUpgrade eap8-resilience4j-retryUpgrade eap8-opensaml-xmlsec-implUpgrade eap8-opensaml-security-implUpgrade eap8-opensaml-saml-apiUpgrade eap8-nimbus-jose-jwtUpgrade eap8-netty-transport-classes-epollUpgrade eap8-lucene-facetUpgrade eap8-infinispan-objectfilterUpgrade eap8-httpcomponents-asyncclientUpgrade eap8-hppcUpgrade eap8-hibernate-validatorUpgrade eap8-bouncycastle-jmailUpgrade eap8-aws-java-sdk-aws-coreUpgrade eap8-apache-sshdUpgrade eap8-artemis-wildfly-integrationUpgrade eap8-apache-commons-beanutilsUpgrade eap8-apache-commons-collectionsUpgrade eap8-activemq-artemis-hqclient-protocolUpgrade eap8-jboss-vfsUpgrade eap8-jakarta-servlet-jsp-jstlUpgrade eap8-resteasy-rxjava2Upgrade eap8-opensaml-xacml-apiUpgrade eap8-wss4jUpgrade eap8-opensaml-profile-apiUpgrade eap8-wildfly-clustering-server-spiUpgrade eap8-wss4j-ws-security-commonUpgrade eap8-wildfly-clustering-server-apiUpgrade eap8-wildfly-client-configUpgrade eap8-resteasy-cryptoUpgrade eap8-objectweb-asm-utilUpgrade eap8-velocity-engine-coreUpgrade eap8-netty-transport-native-unix-commonUpgrade eap8-lucene-joinUpgrade eap8-netty-bufferUpgrade eap8-json-patchUpgrade eap8-jakarta-servlet-jsp-apiUpgrade eap8-jboss-loggingUpgrade eap8-jakarta-websocket-client-apiUpgrade eap8-jackson-dataformat-yamlUpgrade eap8-istack-commons-runtimeUpgrade eap8-codemodelUpgrade eap8-azure-storageUpgrade eap8-apache-mime4j-domUpgrade eap8-apache-cxf-xjc-utilsUpgrade eap8-jackson-coreUpgrade eap8-wildfly-clustering-session-spec-servlet-6.0Upgrade eap8-aesh-extensionsUpgrade eap8-hibernateUpgrade eap8-infinispan-query-coreUpgrade eap8-resteasy-json-binding-providerUpgrade eap8-jakarta-xml-bind-apiUpgrade eap8-activemq-artemisUpgrade eap8-hibernate-validator-cdiUpgrade eap8-apache-mime4j-storageUpgrade eap8-jboss-threadsUpgrade eap8-weld-coreUpgrade eap8-hibernate-coreUpgrade eap8-netty-commonUpgrade eap8-jboss-iiop-clientUpgrade eap8-expresslyUpgrade eap8-jackson-modules-baseUpgrade eap8-byte-buddyUpgrade eap8-hornetq-jakarta-clientUpgrade eap8-wildfly-clustering-session-infinispan-remoteUpgrade eap8-rngomUpgrade eap8-wildfly-clusteringUpgrade eap8-resteasy-jsapiUpgrade eap8-jakarta-activationUpgrade eap8-wildfly-openssl-el10-x86_64-debuginfoUpgrade eap8-infinispan-cachestore-jdbcUpgrade eap8-jboss-genericjmsUpgrade eap8-jgroups-azureUpgrade eap8-insights-java-clientUpgrade eap8-hibernate-searchUpgrade eap8-infinispan-commonsUpgrade eap8-hibernate-search-util-commonUpgrade eap8-jose4jUpgrade eap8-wildfly-discovery-clientUpgrade eap8-resteasy-springUpgrade eap8-weld-lite-extension-translatorUpgrade eap8-wildfly-http-client-commonUpgrade eap8-aws-java-sdk-third-party-jackson-coreUpgrade eap8-jaxbUpgrade eap8-artemis-native-wildflyUpgrade eap8-opensaml-coreUpgrade eap8-infinispanUpgrade eap8-ecjUpgrade eap8-xml-resolverUpgrade eap8-reactivex-rxjava2Upgrade eap8-activemq-artemis-commonsUpgrade eap8-jakarta-jms-apiUpgrade eap8-agroal-poolUpgrade eap8-elytron-webUpgrade eap8-wss4j-policyUpgrade eap8-xml-commons-resolverUpgrade eap8-jboss-jakarta-xml-ws-api_4.0_specUpgrade eap8-wildfly-elytron-toolUpgrade eap8-wildfly-clustering-session-spiUpgrade eap8-netty-handler-proxyUpgrade eap8-netty-codecUpgrade eap8-lucene-queriesUpgrade eap8-jgroups-awsUpgrade eap8-jgroupsUpgrade eap8-jctools-coreUpgrade eap8-jboss-xnio-baseUpgrade eap8-jboss-common-beansUpgrade eap8-jaxb-coreUpgrade eap8-jakarta-validation-apiUpgrade eap8-httpcomponents-clientUpgrade eap8-hibernate-search-engineUpgrade eap8-aws-java-sdk-http-auth-spiUpgrade eap8-cxf-xjc-dvUpgrade eap8-aws-java-sdk-http-authUpgrade eap8-aws-java-sdk-endpoints-spiUpgrade eap8-resilience4j-coreUpgrade eap8-aws-java-sdkUpgrade eap8-atinjectUpgrade eap8-activemq-artemis-jakarta-serverUpgrade eap8-apache-cxf-toolsUpgrade eap8-xsomUpgrade eap8-netty-handlerUpgrade eap8-resteasy-atom-providerUpgrade eap8-narayana-restat-integrationUpgrade eap8-jaxb-runtimeUpgrade eap8-java-classmateUpgrade eap8-jakarta-json-apiUpgrade eap8-wildfly-clustering-contextUpgrade eap8-wss4j-bindingsUpgrade eap8-mod_clusterUpgrade eap8-jsf-implUpgrade eap8-weld-webUpgrade eap8-hornetqUpgrade eap8-hibernate-search-backend-lucene | Jul 23, 2026 | Jul 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub