JBoss Enterprise Application Platform 7.4 Update 22 Release Notes

Updated 4 Dec 2025

In order to better meet customer expectations, micro releases for JBoss EAP 7 have been discontinued and replaced with updates delivered on a repeating schedule.

Each new update will contain a number of bug fixes for customer reported issues and potentially a number of security fixes. We expect that the updates will substantially reduce the number of individual patches that we produce and that customers must manage to keep their installations up to date.

For more information see the following Red Hat Knowledgebase articles: Maintenance Release Changes in EAP 6.2+ and Updated Patch Management with EAP 6.2+

This update includes all fixes and changes from JBoss Enterprise Application Platform 7.4 Update 21

Download This content is not included.JBoss Enterprise Application Platform 7.4 Update 22

This update includes fixes for the following security related issues:

ID	Component	Impact	Summary
CVE-2025-23367	Management	Moderate	org.wildfly.core/wildfly-server: Wildfly improper RBAC permission
CVE-2024-47535	Server	Moderate	io.netty/netty: Denial of Service attack on windows app using Netty
CVE-2025-24970	Server	Important	io.netty/netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine
CVE-2025-25193	Server	Moderate	netty-common: Denial of Service attack on windows app using Netty
CVE-2024-47554	Server	Moderate	commons-io: Possible denial of service attack on untrusted input to XmlStreamReader [eap-7.4.z]

This update includes the following bug fixes or changes:

ID	Component	Summary
This content is not included.JBEAP-28828	CDI / Weld	This content is not included.WELD-2806 - Weld attempts to intercept synthetic methods generated for lambdas by Eclipse ECJ
This content is not included.JBEAP-29421	EJB	DeploymentDescriptorInterceptorBindingsProcessor doesn't take into account superclass methods
This content is not included.JBEAP-29485	EJB	This content is not included.WFLY-20432 - EJB: String[] method parameter in ejb-jar.xml interceptor-binding is failing to deploy
This content is not included.JBEAP-24536	JCA	This content is not included.JBJCA-1465 - JCA pool show negative 'IdleCount'
This content is not included.JBEAP-28152	JCA	This content is not included.JBJCA-1504 - BaseWrapperManagedConnection: flush only closed connection on endRequest notification
This content is not included.JBEAP-28303	JCA	This content is not included.JBJCA-1507 - This content is not included.JBEAP-27222 NPE still remains
This content is not included.JBEAP-28642	Security	Unable to use credential store on FIPS enabled RHEL 8 with Java 17
This content is not included.JBEAP-28731	Undertow	- This content is not included.WFLY-20102 - Server.getRoute with obfuscate-session-route repeats INFO messages and route encoding
This content is not included.JBEAP-28783	Web Console	This content is not included.HAL-2004 - "Error while reading metadata" WFLYCTL0030: No resource definition is registered for address : 'management-operations\active-operation'

Installation

Archive / zip / installer based installations

Note: This update zip should only be applied to installer or zip-based installations.

To apply this update using the CLI on Unix-based systems, run the following command from JBOSS_HOME:

bin/jboss-cli.sh "patch apply path/to/jboss-eap-7.4.22-patch.zip"

To apply this update using the CLI on Windows-based systems, run the following command from JBOSS_HOME:

bin\jboss-cli.bat "patch apply path\to\jboss-eap-7.4.22-patch.zip"

These commands will apply the update to the installation that contains the CLI script. Other scenarios and use of the management console are covered in the JBoss EAP 7.4 Patching And Upgrading Guide