LoginSign Up
← Back to all sparks
W

WildFly

DEVOPS
Velocity2.5

Modular Jakarta EE application server for building and running Java applications

www.wildfly.org ↗

WildFly's first 41.x patch is a security release, with three IIOP CVEs closed at once

jakarta eesecurityiiopcveapplication server
◆Current state
WildFly runs a steady train: a Beta, a .0.Final, then a patch release that consolidates fixes and component upgrades. WildFly 41 arrived in July with OIDC scope and request-object support promoted out of preview. The first patch on that line is dominated by security — three CVEs in the IIOP stack covering unauthenticated class loading, a missing-authentication path on the NameService, and a pre-auth denial of service on the listener — plus a long run of dependency upgrades that resolve further advisories.
◆Where it's heading
The releases show the split personality of a mature application server: feature work concentrates in the Beta and .0.Final, while the .1 patch exists to move CVE fixes and component versions to users quickly. The recurring theme across 40.x and 41.x is that the ageing edges of the platform — IIOP, the OIDC client, container base images — are where the risk keeps surfacing, and each patch prunes a little more. WildFly 40.0.1 used the same slot to move container images to JDK 25 and drop JDK 17.
◆Prediction
Expect a 42 Beta to open the next feature cycle while 41.x continues absorbing component upgrades and advisory fixes on the same patch cadence.

◆Recent moves

  1. 21d ago

    WildFly 41.0.1 closes three IIOP CVEs and a Mojarra advisory

    The first 41.x patch is primarily a security release: three IIOP CVEs — unauthenticated class loading, a missing-authentication NameService path, and a pre-auth listener denial of service — land alongside upgrades to RESTEasy, Mojarra, CXF, Netty and lz4-java that resolve further advisories. Functional fixes are narrow, covering cache listeners on resume and OIDC logout attribute parsing.

    View source ↗
  2. 2mo ago

    WildFly 41 promotes OIDC scope and request-object support

    The 41.0.0 final promoted OIDC scope and request-object handling to default stability, the feature payload this patch line is now maintaining.

    View source ↗
  3. 2mo ago

    WildFly 41 Beta adds transactions during graceful shutdown

    The 41 Beta allowed transactions to continue through graceful shutdown, an operational refinement typical of where WildFly spends its feature budget.

    View source ↗
  4. 2mo ago

    WildFly 40.0.1 moves container images to JDK 25, drops JDK 17

    The previous line's patch release did the same job this one does — moving the runtime baseline forward rather than adding surface, in that case retiring JDK 17 from container images.

    View source ↗
  5. 3mo ago

    WildFly 40 lands Jakarta Pages 4.0 and WebSocket 2.2 in Preview

    Jakarta Pages 4.0 and WebSocket 2.2 arrived in the Preview stability level, following the pattern of staging specification updates before promotion.

    View source ↗
  6. 4mo ago

    WildFly 40 Beta fixes an Elytron brute-force CVE

    An earlier Beta carrying its own CVE fix in Elytron, confirming that security work reaches users through whichever release is next rather than waiting for a patch slot.

    View source ↗