Skip to content
Fencer Vulns
medium 6.5

CVE-2025-12799 json

Jastow: jastow cross-site scripting attack due to unsanitized uri

published 2026-07-07 4 mo ago modified 2026-09-29 40 d ago also EUVD-2025-210439

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling.

Patch / fix

  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA 2.2.9.SP1-redhat-00001
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 0:0.8.12-1.redhat_00001.1.el10eap, 0:1-9.el10eap, 0:1.8.0-2.redhat_00001.1.el10eap, 0:1.9.0-1.redhat_00001.1.el10eap, 0:1.11.0-1.redhat_00001.1.el10eap, 0:1.17.2-1.redhat_00001.1.el10eap, 0:2.0.3-1.redhat_00001.1.el10eap, 0:2.0.4-1.Final_redhat_00001.1.el10eap, 0:2.0.5-1.redhat_00001.1.el10eap, 0:2.3.0-1.redhat_00001.1.el10eap, 0:2.4.0-1.redhat_00002.1.el10eap, 0:2.14.0-4.redhat_00003.1.el10eap, 0:2.16.1-2.redhat_00002.1.el10eap, 0:2.40.0-7.redhat_00015.1.el10eap, 0:3.2.2-28.redhat_2.1.el10eap, 0:3.18.0-2.redhat_00003.1.el10eap, 0:4.0.10-3.redhat_00001.1.el10eap, 0:4.1.0-1.redhat_00001.1.el10eap, 0:4.13.2-1.redhat_00001.1.el10eap, 1:2.0.0-2.redhat_00005.1.el10eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:2.0.4-1.Final_redhat_00001.1.el8eap, 0:2.2.9-1.SP1_redhat_00001.1.el8eap, 0:2.3.24-4.SP3_redhat_00001.1.el8eap, 0:2.6.9-1.Final_redhat_00001.1.el8eap, 0:4.0.10-3.redhat_00001.1.el8eap, 0:6.6.50-1.Final_redhat_00001.1.el8eap, 0:7.3.8-1.Final_redhat_00001.1.el8eap, 0:8.1.1-11.GA_redhat_00019.1.el8eap, 0:8.1.7-4.GA_redhat_00003.1.el8eap, 0:801.7.0-1.GA_redhat_00001.1.el8eap, 1:5.3.23-1.Final_redhat_00001.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:2.0.4-1.Final_redhat_00001.1.el9eap, 0:2.2.9-1.SP1_redhat_00001.1.el9eap, 0:2.3.24-4.SP3_redhat_00001.1.el9eap, 0:2.6.9-1.Final_redhat_00001.1.el9eap, 0:4.0.10-3.redhat_00001.1.el9eap, 0:6.6.50-1.Final_redhat_00001.1.el9eap, 0:7.3.8-1.Final_redhat_00001.1.el9eap, 0:8.1.1-11.GA_redhat_00019.1.el9eap, 0:8.1.7-4.GA_redhat_00003.1.el9eap, 0:801.7.0-1.GA_redhat_00001.1.el9eap, 1:5.3.23-1.Final_redhat_00001.1.el9eap
  • eap8 jboss enterprise application platform 8.1 1-9.el10eap
  • eap8-ecj jboss enterprise application platform 8.1 1:3.33.0-1.redhat_00001.1.el10eap
  • eap8-vdx jboss enterprise application platform 8.1 1.1.6-3.redhat_1.1.el10eap
  • eap8-gson jboss enterprise application platform 8.1 2.10.1-2.redhat_00005.1.el10eap
  • eap8-hppc jboss enterprise application platform 8.1 0.10.0-2.redhat_00001.1.el10eap
  • eap8-jaxb jboss enterprise application platform 8.1 4.0.6-1.redhat_00001.1.el10eap
  • eap8-txw2 jboss enterprise application platform 8.1 4.0.6-1.redhat_00001.1.el10eap
  • eap8-xsom jboss enterprise application platform 8.1 4.0.6-1.redhat_00001.1.el10eap

red hat advisories RHSA-2026:36344RHSA-2026:36342RHSA-2026:36343

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-12799 updated cvss 6.5

jastow: Jastow Cross-Site Scripting attack due to unsanitized URI

  • Red Hat JBoss Enterprise Application Platform 7 jastow, io.undertow.jastow-jastow, eap74-els-openjdk8-openshift-rhel8, eap74-els-openjdk11-openshift-rhel8, eap74-els-openjdk17-openshift-rhel8, jboss-eap-7/eap74-els-openjdk8-openshift-rhel8, +1 more Red Hat JBoss Enterprise Application Platform 8 jastow Red Hat JBoss Enterprise Application Platform Expansion Pack jastow Red Hat Single Sign-On 7 jastow
    affected: workaround, no fix available “Fix deferred”
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-wildfly 8.1.7-4.GA_redhat_00003.1.el8eap, eap8-apache-cxf 4.0.10-3.redhat_00001.1.el8eap, eap8-undertow 2.3.24-4.SP3_redhat_00001.1.el8eap, eap8-apache-cxf-rt 4.0.10-3.redhat_00001.1.el8eap, eap8-jgroups 5.3.23-1.Final_redhat_00001.1.el8eap, eap8-hibernate 6.6.50-1.Final_redhat_00001.1.el8eap, +15 more
    fixed: vendor fix RHSA-2026:36342
  • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-wildfly 8.1.7-4.GA_redhat_00003.1.el9eap, eap8-apache-cxf 4.0.10-3.redhat_00001.1.el9eap, eap8-undertow 2.3.24-4.SP3_redhat_00001.1.el9eap, eap8-apache-cxf-rt 4.0.10-3.redhat_00001.1.el9eap, eap8-jgroups 5.3.23-1.Final_redhat_00001.1.el9eap, eap8-hibernate 6.6.50-1.Final_redhat_00001.1.el9eap, +15 more
    fixed: vendor fix RHSA-2026:36343
  • Red Hat JBoss EAP 8.1 for RHEL 10 eap8 1-9.el10eap, eap8-runtime 1-9.el10eap, eap8-vdx 1.1.6-3.redhat_1.1.el10eap, eap8-javapackages-tools 6.0.0-8.el10eap, eap8-ecj 3.33.0-1.redhat_00001.1.el10eap, eap8-jaxb 4.0.6-1.redhat_00001.1.el10eap, +448 more
    fixed: vendor fix RHSA-2026:36344
  • Red Hat JBoss Enterprise Application Platform 8.1.7.GA jastow 2.2.9.SP1-redhat-00001
    fixed: vendor fix RHSA-2026:36345
  • Red Hat JBoss Enterprise Application Platform 8.1.7.GA pom.xml, aesh 2.4, c3 0.6.4, d3 7.4.3, he 1.2.0, lr 1.4.2, +1866 more Red Hat JBoss Enterprise Application Platform Expansion Pack io.undertow.jastow-jastow
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Affected products

  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Single Sign-On 7

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.