JBoss Enterprise Application Platform 7.4 Update 16 Release Notes

Updated 2 Jul 2025

In order to better meet customer expectations, micro releases for JBoss EAP 7 have been discontinued and replaced with updates delivered on a repeating schedule.

Each new update will contain a number of bug fixes for customer reported issues and potentially a number of security fixes. We expect that the updates will substantially reduce the number of individual patches that we produce and that customers must manage to keep their installations up to date.

For more information see the following Red Hat Knowledgebase articles: Maintenance Release Changes in EAP 6.2+ and Updated Patch Management with EAP 6.2+

This update includes all fixes and changes from JBoss Enterprise Application Platform 7.4 Update 15

Download This content is not included.JBoss Enterprise Application Platform 7.4 Update 16

This update includes fixes for the following security related issues:

ID	Component	Impact	Summary
CVE-2024-1102	Server	Moderate	jberet-core: jberet: jberet-core logging database credentials
CVE-2023-48795	Server	Moderate	apache-sshd: ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
CVE-2024-1635	Server	Important	undertow: Out-of-memory Error after several closed connections with wildfly-http-client protocol
CVE-2023-4639	Undertow	Moderate	undertow: Cookie Smuggling/Spoofing
CVE-2023-1973	Undertow	Important	undertow: unrestricted request storage leads to memory exhaustion

This update includes the following bug fixes or changes:

ID	Component	Summary
This content is not included.JBEAP-14012	ActiveMQ	AMQ212051: Invalid concurrent session usage.
This content is not included.JBEAP-26403	Clustering	This content is not included.WFLY-18914 - Shared distributed session manager triggers duplicate expiration listeners
This content is not included.JBEAP-25503	Clustering	max-active-sessions=-1 causes ISPN000424 error
This content is not included.JBEAP-26462	EJB	OOM Error after node restart, in a 4 nodes cluster
This content is not included.JBEAP-26328	Hibernate	Content from hibernate.atlassian.net is not included.HHH-17532 Load-collection fails with NPE when collection is part of embeddable
This content is not included.JBEAP-26317	Hibernate	Content from hibernate.atlassian.net is not included.HHH-17380 - Persisting an entity with a non generated id and @MapsId throws PropertyValueException
This content is not included.JBEAP-26506	Insights	Use Bearer token auth instead of Basic token auth
This content is not included.JBEAP-26395	JMS	"AMQ229014: Did not receive data from invm:0 within the -1ms connection TTL" occurs due to a race condition [details]
This content is not included.JBEAP-26455	JMX	NullPointerException during fetching infinispan statistics via JMX.
This content is not included.JBEAP-26763	JSF	Unexpected exception when attempting to tear down the Mojarra
This content is not included.JBEAP-26624	Scripts	This content is not included.WFCORE-6531 - standalone.sh and possibly other scripts usage of eval
This content is not included.JBEAP-25918	Security	This content is not included.ELY-2538 - Provide a possibility for a caching realm to authenticate users with underlying realm when credential verification with cached credential fails
This content is not included.JBEAP-25916	Security	This content is not included.WFCORE-6411 - Make it possible to use JaasSecurityRealm via a custom-realm resource
This content is not included.JBEAP-25917	Security	This content is not included.WFLY-18163 - Make it possible to use JaasSecurityRealm via a custom-realm resource
This content is not included.JBEAP-25796	Security	This content is not included.ELY-2589 - Elytron SSO does not expire other application sessions for session invalidation like Undertow SSO promptly following sessionid change
This content is not included.JBEAP-26219	Server	This content is not included.WFLY-18765 - Missing Locale parameter while calling toUpperCase and toLowerCase methods
This content is not included.JBEAP-25579	Undertow	This content is not included.UNDERTOW-2304 - Prevent repeating SslConduit.doUnwrap under task thread exhaustion conditions
This content is not included.JBEAP-26355	Undertow	This content is not included.UNDERTOW-2337 - Multipart form-data larger than 16KiB is not available through Servlet getParameter API after EAP 7.4.12 (CVE-2023-3223 / This content is not included.UNDERTOW-2271 fix) [details]
This content is not included.JBEAP-26103	Web Console	This content is not included.HAL-1945 - Badge icon is not displayed in Web Console
This content is not included.JBEAP-25663	Web Console	This content is not included.HAL-1906 - Encode prefix in data source pool name

Installation

Archive / zip / installer based installations

Note: This update zip should only be applied to installer or zip-based installations.

To apply this update using the CLI on Unix-based systems, run the following command from JBOSS_HOME:

bin/jboss-cli.sh "patch apply path/to/jboss-eap-7.4.16-patch.zip"

To apply this update using the CLI on Windows-based systems, run the following command from JBOSS_HOME:

bin\jboss-cli.bat "patch apply path\to\jboss-eap-7.4.16-patch.zip"

These commands will apply the update to the installation that contains the CLI script. Other scenarios and use of the management console are covered in the JBoss EAP 7.4 Patching And Upgrading Guide