Описание
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Enterprise Application Platform 8 | jboss-marshalling-river | Affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | wildfly-clustering-infinispan-marshalling | Affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | jboss-marshalling-river | Affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | wildfly-clustering-infinispan-marshalling | Affected | ||
| Red Hat JBoss Enterprise Application Platform 7.4.25 | jboss-marshalling-river | Fixed | RHSA-2026:53806 | 11.08.2026 |
| Red Hat JBoss Enterprise Application Platform 7.4.25 | wildfly-clustering-infinispan-marshalling | Fixed | RHSA-2026:53806 | 11.08.2026 |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | eap7-activemq-artemis | Fixed | RHSA-2026:53644 | 11.08.2026 |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | eap7-glassfish-jsf | Fixed | RHSA-2026:53644 | 11.08.2026 |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | eap7-ironjacamar | Fixed | RHSA-2026:53644 | 11.08.2026 |
| Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | eap7-jackson-annotations | Fixed | RHSA-2026:53644 | 11.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
EPSS
8.8 High
CVSS3