Red Hat Red Hat JBoss Enterprise Application Platform 8.1

• CVE-2026-93579 Medium 6.5 Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough) 0.9%
• CVE-2026-93568 High 7.5 Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests 1.0%
• CVE-2026-93569 High 8.2 Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority 2.2%
• CVE-2026-93567 High 7.5 Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority 2.6%
• CVE-2026-93492 Medium 5.3 Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size 0.4%
• CVE-2026-89058 High 7.4 Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config 0.5%
• CVE-2026-89059 High 7.5 Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) 1.5%
• CVE-2026-17615 High 7.5 Resteasy-core: resteasy sourceprovider remote unauthenticated file read 0.8%