VDB
RHSA-2026:70230
RHSA-2026:70230
PUBLISHED
CVSS 4.199999809265137 MEDIUM
Record from redhat · Published September 22, 2026
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.
Risk scores
CVSS 3.1
4.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | eap8-jackson-annotations-0:2.18.9-1.redhat_00003.1.el10eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:2.18.9-1.redhat_00003.1.el10eap |
| Red Hat | eap8-wildfly-0:8.1.8-9.GA_redhat_00006.1.el10eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:8.1.8-9.GA_redhat_00006.1.el10eap |
| Red Hat | eap8-xml-security-0:3.0.6-1.redhat_00001.1.el10eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:3.0.6-1.redhat_00001.1.el10eap |
| Red Hat | eap8-bouncycastle-0:1.85.0-1.redhat_00001.1.el10eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:1.85.0-1.redhat_00001.1.el10eap |
| Red Hat | eap8-artemis-wildfly-integration-0:2.0.5-1.Final_redhat_00001.1.el10eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:2.0.5-1.Final_redhat_00001.1.el10eap |
| Red Hat | eap8-parsson-0:1.1.9-1.redhat_00001.1.el10eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:1.1.9-1.redhat_00001.1.el10eap |
| Red Hat | eap8-rngom-0:4.0.7-4.redhat_00001.1.el10eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:4.0.7-4.redhat_00001.1.el10eap |
| Red Hat | eap8-bouncycastle-prov-0:1.85.0-1.redhat_00001.1.el10eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:1.85.0-1.redhat_00001.1.el10eap |
| Red Hat | eap8-netty-common-0:4.1.136-1.Final_redhat_00001.1.el10eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:4.1.136-1.Final_redhat_00001.1.el10eap |
| Red Hat | eap8-ironjacamar-common-api-0:3.0.22-1.Final_redhat_00001.1.el10eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:3.0.22-1.Final_redhat_00001.1.el10eap |
| Red Hat | eap8-relaxng-datatype-0:4.0.7-4.redhat_00001.1.el10eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:4.0.7-4.redhat_00001.1.el10eap |
| Red Hat | eap8-activemq-artemis-0:2.40.0-8.redhat_00024.1.el10eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:2.40.0-8.redhat_00024.1.el10eap |
| Red Hat | eap8-ironjacamar-deployers-common-0:3.0.22-1.Final_redhat_00001.1.el10eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:3.0.22-1.Final_redhat_00001.1.el10eap |
| Red Hat | eap8-netty-transport-classes-epoll-0:4.1.136-1.Final_redhat_00001.1.el10eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:4.1.136-1.Final_redhat_00001.1.el10eap |
| Red Hat | eap8-netty-buffer-0:4.1.136-1.Final_redhat_00001.1.el10eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:4.1.136-1.Final_redhat_00001.1.el10eap |
| Red Hat | eap8-netty-transport-native-epoll-0:4.1.136-1.Final_redhat_00001.1.el10eap.x86_64 as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:4.1.136-1.Final_redhat_00001.1.el10eap |
| Red Hat | eap8-eap-product-conf-parent-0:801.8.0-1.GA_redhat_00001.1.el10eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:801.8.0-1.GA_redhat_00001.1.el10eap |
| Red Hat | eap8-bouncycastle-jmail-0:1.85.0-1.redhat_00001.1.el10eap.noarch as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:1.85.0-1.redhat_00001.1.el10eap |
| Red Hat | eap8-jbossws-common-tools-0:2.2.0-1.Final_redhat_00001.1.el10eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:2.2.0-1.Final_redhat_00001.1.el10eap |
| Red Hat | eap8-jackson-modules-base-0:2.18.9-1.redhat_00003.1.el10eap.src as a component of Red Hat JBoss EAP 8.1 for RHEL 10 | 0:2.18.9-1.redhat_00003.1.el10eap |
…and 127 more
Timeline
- Sep 22, 2026 CVE Published
- Oct 1, 2026 CVE Updated
- Oct 1, 2026 Distribution Patch (2 in total, the first dated here)
- Oct 1, 2026 Security Advisory (37 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln RHSA-2026:70230
vulnetix vdb fixes RHSA-2026:70230Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%3A70230/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://access.redhat.com/errata/RHSA-2026:70230 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1 advisory
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index advisory
- https://access.redhat.com/articles/7137769 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2455350 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2458638 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2477930 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2477945 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2478013 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480601 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480637 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480638 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2480729 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2483131 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2483133 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2483135 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2483136 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2483138 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2483140 issue
…and 212 more