JBoss Enterprise Application Platform 7.4 Update 25 Release Notes
Updated
In order to better meet customer expectations, micro releases for JBoss EAP 7 have been discontinued and replaced with updates delivered on a repeating schedule.
Each new update will contain a number of bug fixes for customer reported issues and potentially a number of security fixes. We expect that the updates will substantially reduce the number of individual patches that we produce and that customers must manage to keep their installations up to date.
For more information see the following Red Hat Knowledgebase articles: Maintenance Release Changes in EAP 6.2+ and Updated Patch Management with EAP 6.2+
This update includes all fixes and changes from JBoss Enterprise Application Platform 7.4 Update 24
Download This content is not included.JBoss Enterprise Application Platform 7.4 Update 25
This update includes fixes for the security related issues listed below. If using AJP, note that the This content is not included.CVE-2026-15554 fix will require a configuration change, see details:
| ID | Component | Impact | Summary |
|---|---|---|---|
| This content is not included.CVE-2026-27446 | ActiveMQ | Important | artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication |
| This content is not included.CVE-2026-15555 | Clustering | Important | wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller |
| This content is not included.CVE-2026-15560 | IIOP | Important | openjdk-orb: unauthed class loading via IIOP in EAP |
| This content is not included.CVE-2026-15563 | IIOP | Important | wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS |
| This content is not included.CVE-2026-15567 | IIOP | Important | wildfly-iiop-openjdk: Wildfly: Pre-auth denial of service on the IIOP listener |
| This content is not included.CVE-2026-15562 | IO | Important | jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of service |
| This content is not included.CVE-2026-46581 | JSF | Important | jsf-impl: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include |
| This content is not included.CVE-2026-15556 | Security | Important | picketlink-federation: picketlink SAML 2.0 auth bypass via missing assertions |
| This content is not included.CVE-2026-10579 | Security | Critical | picketlink-federation: auth bypass in Picketlink SAML unsolicited-response |
| This content is not included.CVE-2026-46340 | Server | Important | netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments |
| This content is not included.CVE-2026-5598 | Server | Important | bcprov-jdk12: private key leakage via non-constant time comparisons |
| This content is not included.CVE-2026-48043 | Server | Important | netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak |
| This content is not included.CVE-2026-47691 | Server | Important | netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records |
| This content is not included.CVE-2026-68494 | Server | Important | eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8: jackson-core: Denial of Service via incomplete fix in async JSON parser |
| This content is not included.CVE-2025-14813 | Server | Important | bcprov-jdk12: GOSTCTR implementation unable to process more than 255 blocks correctly |
| This content is not included.CVE-2026-42579 | Server | Important | netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement |
| This content is not included.CVE-2026-42578 | Server | Important | netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation |
| This content is not included.CVE-2026-44893 | Server | Important | netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message |
| This content is not included.CVE-2026-48059 | Server | Important | netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers |
| This content is not included.CVE-2026-44250 | Server | Important | netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays |
| This content is not included.CVE-2026-44890 | Server | Important | netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads |
| This content is not included.CVE-2026-50193 | Server | Important | eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8: Jackson-databind: Denial of Service via deeply nested JSON processing |
| This content is not included.CVE-2026-50010 | Server | Important | netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass |
| This content is not included.CVE-2026-50011 | Server | Important | netty-codec-redis: Netty: Denial of Service via malicious Redis array header |
| This content is not included.CVE-2026-54512 | Server | Important | eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass |
| This content is not included.CVE-2026-0636 | Server | Important | bcprov-jdk12: LDAP injection vulnerability in LDAPStoreHelper.java |
| This content is not included.CVE-2026-45416 | Server | Important | netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake |
| This content is not included.CVE-2026-41417 | Server | Moderate | netty-codec-http: Netty: HTTP request smuggling via URI manipulation and CRLF injection |
| This content is not included.CVE-2026-42584 | Server | Important | netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion |
| This content is not included.CVE-2026-42581 | Server | Important | netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers |
| This content is not included.CVE-2026-44249 | Server | Important | netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation |
| This content is not included.CVE-2026-5588 | Server | Important | bcpkix-jdk15on: PKIX draft CompositeVerifier accepts empty signature sequence as valid |
| This content is not included.CVE-2026-48006 | Server | Important | netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator |
| This content is not included.CVE-2026-3505 | Server | Important | bcpg-jdk15on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion |
| This content is not included.CVE-2026-42587 | Server | Important | netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression |
| This content is not included.CVE-2026-45674 | Server | Important | netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation |
| This content is not included.CVE-2026-42585 | Server | Moderate | netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing |
| This content is not included.CVE-2026-15561 | Undertow | Important | undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow |
| This content is not included.CVE-2026-15554 | Undertow | Important | undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery [details] |
| This content is not included.CVE-2026-15565 | Web Sockets | Important | undertow-websockets-jsr: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method |
This update includes the following bug fixes or changes:
| ID | Component | Summary |
|---|---|---|
| This content is not included.JBEAP-30462 | Embedded | embed-server can delete the same tmp/vfs directory for running server [details] |
| This content is not included.JBEAP-32749 | JCA | This content is not included.JBJCA-1535 - BaseWrappedManagedConnection: failure to reset inLocalTransaction field during cleanup leads to failures when connection is reused |
| This content is not included.JBEAP-32868 | JCA | This content is not included.JBJCA-1536 - cl.destroy() called inside connectionLock in returnConnection() causes deadlock with IBM MQ ConnectionEventHandler |
| Content from redhat.atlassian.net is not included.JBEAP-30996 | Undertow | This content is not included.UNDERTOW-2611 - Ensure max-request-size of a Multipart servlet can override a listener max-post-size |
| Content from redhat.atlassian.net is not included.JBEAP-33002 | Undertow | This content is not included.UNDERTOW-2757 - getQueryString still returns decoded value |
Installation
Archive / zip / installer based installations
Note: This update zip should only be applied to installer or zip-based installations.
To apply this update using the CLI on Unix-based systems, run the following command from JBOSS_HOME:
bin/jboss-cli.sh "patch apply path/to/jboss-eap-7.4.25-patch.zip"
To apply this update using the CLI on Windows-based systems, run the following command from JBOSS_HOME:
bin\jboss-cli.bat "patch apply path\to\jboss-eap-7.4.25-patch.zip"
These commands will apply the update to the installation that contains the CLI script. Other scenarios and use of the management console are covered in the JBoss EAP 7.4 Patching And Upgrading Guide
RPM installations
See the documentation: Updating an RPM installation
OpenShift Container installations
Update the containers to use the This content is not included.latest tag, to be current on JBoss EAP bug fixes as well as OpenJDK and RHEL fixes.
This content is not included.Known Issues
Notes
- JBoss EAP 7.x is going into Extended Life Support phase on June 30, 2025, at which point an ELS subscription will be required for continued support.
- JBoss EAP 7.4 Update 13+ contains some bug fixes that did not make it into EAP 8.0 GA, it is recommended you move to EAP 8.0 latest Update
- Red Hat Insights is available for JBoss EAP 7.4 Update 11+ and accessible on the This content is not included.Red Hat Hybrid Cloud Console, see more details.
- Helm Chart for EAP 7.4 Updates
- The EAP natives for s390x platform (IBM zSeries) are only supported in the OpenShift environment on IBM zSeries, i.e bare metal installations on IBM zSeries are not supported.
- Some JBoss EAP image templates depend on other products that may not have a s390x build, see here for more details
- The Helm Chart for JBoss EAP 7.4 / JBoss EAP XP 3 allows to build and deploy applications on OpenShift using Helm package manager
- The IBM WebSphere MQ broker was updated to 9.2 for integration testing, see the Red Hat JBoss Enterprise Application Platform (EAP) 7 Tested Integrations for more details.
- Hibernate Search 5 APIs Deprecated in JBoss EAP 7.4 that will be changed in EAP 8 / Hibernate 6
- The RHSSO Galleon Layer is deprecated in JBoss EAP 7.4, see more details.
- JBoss EAP 7.4 Update 8+ now supports OpenJDK 17 / Oracle JDK 17, see configuration changes needed here.
- Deprecated in Red Hat Enterprise Application Platform (EAP) 7
- jndi-name has been required for admin-object definitions as per the schema, the server will require it to be specified or will result in an error, see more details here
Category
Components
Article Type