VDB
RHSA-2026:70229
RHSA-2026:70229
PUBLISHED
CVSS 4.199999809265137 MEDIUM
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
Risk Scores
CVSS 3.1
4.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | eap8-activemq-artemis-jakarta-server-0:2.40.0-8.redhat_00024.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 2.40.0-8.redhat |
| Red Hat | eap8-wildfly-0:8.1.8-9.GA_redhat_00006.1.el9eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 8.1.8-9.GA |
| Red Hat | eap8-jsf-impl-0:4.0.11-2.SP1_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 4.0.11-2.SP1 |
| Red Hat | eap8-wildfly-elytron-0:2.6.11-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 2.6.11-1.Final |
| Red Hat | eap8-netty-transport-native-epoll-0:4.1.136-1.Final_redhat_00001.1.el9eap.x86_64 as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 4.1.136-1.Final |
| Red Hat | eap8-slf4j-0:2.0.18-1.redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 2.0.18-1.redhat |
| Red Hat | eap8-activemq-artemis-jakarta-service-extensions-0:2.40.0-8.redhat_00024.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 2.40.0-8.redhat |
| Red Hat | eap8-activemq-artemis-selector-0:2.40.0-8.redhat_00024.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 2.40.0-8.redhat |
| Red Hat | eap8-jbossws-spi-0:5.1.0-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 5.1.0-1.Final |
| Red Hat | eap8-xml-security-0:3.0.6-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 3.0.6-1.redhat |
| Red Hat | eap8-apache-cxf-0:4.1.7-1.SP1_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 4.1.7-1.SP1 |
| Red Hat | eap8-ironjacamar-0:3.0.22-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 3.0.22-1.Final |
| Red Hat | eap8-jackson-modules-java8-0:2.18.9-1.redhat_00003.1.el9eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 2.18.9-1.redhat |
| Red Hat | eap8-netty-handler-proxy-0:4.1.136-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 4.1.136-1.Final |
| Red Hat | eap8-wildfly-java-jdk17-0:8.1.8-9.GA_redhat_00006.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 8.1.8-9.GA |
| Red Hat | eap8-jaxb-jxc-0:4.0.7-4.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 4.0.7-4.redhat |
| Red Hat | eap8-activemq-artemis-server-0:2.40.0-8.redhat_00024.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 2.40.0-8.redhat |
| Red Hat | eap8-eap-product-conf-parent-0:801.8.0-1.GA_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 801.8.0-1.GA |
| Red Hat | eap8-activemq-artemis-commons-0:2.40.0-8.redhat_00024.1.el9eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 2.40.0-8.redhat |
| Red Hat | eap8-jackson-annotations-0:2.18.9-1.redhat_00003.1.el9eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 9 | 2.18.9-1.redhat |
…and 128 more
Timeline
- Sep 22, 2026 CVE Published
- Oct 1, 2026 CVE Updated
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Distribution Patch
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
- Oct 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:70229 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1 advisory
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index advisory
- https://access.redhat.com/articles/7137769 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2455350 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2458638 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2477930 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2477945 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2478013 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480601 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480637 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480638 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480729 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2483131 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2483133 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2483135 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2483136 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2483138 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2483140 issue
…and 212 more