JBoss Enterprise Application Platform 7.4 Update 18 Release Notes

Updated 30 Oct 2025

In order to better meet customer expectations, micro releases for JBoss EAP 7 have been discontinued and replaced with updates delivered on a repeating schedule.

Each new update will contain a number of bug fixes for customer reported issues and potentially a number of security fixes. We expect that the updates will substantially reduce the number of individual patches that we produce and that customers must manage to keep their installations up to date.

For more information see the following Red Hat Knowledgebase articles: Maintenance Release Changes in EAP 6.2+ and Updated Patch Management with EAP 6.2+

This update includes all fixes and changes from JBoss Enterprise Application Platform 7.4 Update 17

Download This content is not included.JBoss Enterprise Application Platform 7.4 Update 18

This update includes fixes for the following security related issues:

ID	Component	Impact	Summary
CVE-2024-5971	Server	Major	undertow: response write hangs in case of Java 17 TLSv1.3 NewSessionTicket
CVE-2024-3653	Undertow	Low	undertow: LearningPushHandler can lead to remote memory DoS attacks
CVE-2024-30172		Major	org.bouncycastle:bcprov-jdk18on: Infinite loop in ED25519 verification in the ScalarUtil class
CVE-2024-30171	Security	Moderate	org.bouncycastle-bcprov-jdk18on: BouncyCastle vulnerable to a timing variant of Bleichenbacher (Marvin Attack)
CVE-2024-27316	Undertow	Moderate	HTTP-2: httpd: CONTINUATION frames DoS
CVE-2024-29857	Server	Moderate	org.bouncycastle:bcprov-jdk18on: org.bouncycastle: Importing an EC certificate with crafted F2m parameters may lead to Denial of Service
CVE-2024-29025	JMS	Moderate	netty-codec-http: Allocation of Resources Without Limits or Throttling

This update includes the following bug fixes or changes:

ID	Component	Summary
This content is not included.JBEAP-27126	JCA	This content is not included.JBJCA-1483 - "SQLNonTransientConnectionException: Can't call rollback when autocommit=true" can happen because TxConnectionListener#tidyup() does not reset localTransaction field to false
This content is not included.JBEAP-27100	Logging	Logger is slower with log4j filter on JDK11
This content is not included.JBEAP-27014	Undertow	This content is not included.UNDERTOW-2383 - Canonicalized query string in redirect location can break included links
This content is not included.JBEAP-27062	Undertow	This content is not included.UNDERTOW-2389/This content is not included.UNDERTOW-2385 - DefaultByteBufferPool leaks buffers for released threads [details]
This content is not included.JBEAP-26990	Undertow	This content is not included.UNDERTOW-2409 / This content is not included.UNDERTOW-2378 - Adjust properly session timeout also in case when custom auth mechanisms are used
This content is not included.JBEAP-27012	Web Console	This content is not included.HAL-1976 - Status page improperly converts uptime from ms to readable format

Installation

Archive / zip / installer based installations

Note: This update zip should only be applied to installer or zip-based installations.

To apply this update using the CLI on Unix-based systems, run the following command from JBOSS_HOME:

bin/jboss-cli.sh "patch apply path/to/jboss-eap-7.4.18-patch.zip"

To apply this update using the CLI on Windows-based systems, run the following command from JBOSS_HOME:

bin\jboss-cli.bat "patch apply path\to\jboss-eap-7.4.18-patch.zip"

These commands will apply the update to the installation that contains the CLI script. Other scenarios and use of the management console are covered in the JBoss EAP 7.4 Patching And Upgrading Guide