Skip to content
OpenAdvisories
High RHSA-2025:13685 2 CVEs

Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.2 release and security update

Published Aug 14, 2025 · Updated Sep 17, 2026

Ecosystem: Red Hat

Fixed packages 30

ReleasePackageFixed in
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el10 jws6-tomcat 0:10.1.36-8.redhat_00009.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el10 jws6-tomcat-admin-webapps 0:10.1.36-8.redhat_00009.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el10 jws6-tomcat-docs-webapp 0:10.1.36-8.redhat_00009.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el10 jws6-tomcat-el-5.0-api 0:10.1.36-8.redhat_00009.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el10 jws6-tomcat-javadoc 0:10.1.36-8.redhat_00009.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el10 jws6-tomcat-jsp-3.1-api 0:10.1.36-8.redhat_00009.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el10 jws6-tomcat-lib 0:10.1.36-8.redhat_00009.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el10 jws6-tomcat-selinux 0:10.1.36-8.redhat_00009.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el10 jws6-tomcat-servlet-6.0-api 0:10.1.36-8.redhat_00009.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el10 jws6-tomcat-webapps 0:10.1.36-8.redhat_00009.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el8 jws6-tomcat 0:10.1.36-8.redhat_00009.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el8 jws6-tomcat-admin-webapps 0:10.1.36-8.redhat_00009.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el8 jws6-tomcat-docs-webapp 0:10.1.36-8.redhat_00009.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el8 jws6-tomcat-el-5.0-api 0:10.1.36-8.redhat_00009.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el8 jws6-tomcat-javadoc 0:10.1.36-8.redhat_00009.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el8 jws6-tomcat-jsp-3.1-api 0:10.1.36-8.redhat_00009.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el8 jws6-tomcat-lib 0:10.1.36-8.redhat_00009.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el8 jws6-tomcat-selinux 0:10.1.36-8.redhat_00009.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el8 jws6-tomcat-servlet-6.0-api 0:10.1.36-8.redhat_00009.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el8 jws6-tomcat-webapps 0:10.1.36-8.redhat_00009.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el9 jws6-tomcat 0:10.1.36-8.redhat_00009.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el9 jws6-tomcat-admin-webapps 0:10.1.36-8.redhat_00009.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el9 jws6-tomcat-docs-webapp 0:10.1.36-8.redhat_00009.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el9 jws6-tomcat-el-5.0-api 0:10.1.36-8.redhat_00009.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el9 jws6-tomcat-javadoc 0:10.1.36-8.redhat_00009.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el9 jws6-tomcat-jsp-3.1-api 0:10.1.36-8.redhat_00009.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el9 jws6-tomcat-lib 0:10.1.36-8.redhat_00009.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el9 jws6-tomcat-selinux 0:10.1.36-8.redhat_00009.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el9 jws6-tomcat-servlet-6.0-api 0:10.1.36-8.redhat_00009.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.1::el9 jws6-tomcat-webapps 0:10.1.36-8.redhat_00009.1.el9jws

Vulnerabilities 2

  • High 7.5
    CVE-2025-48989

    Apache Tomcat: h2 DoS - Made You Reset

    Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older,…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  • High 7.5
    CVE-2025-52520

    Apache Tomcat: DoS via integer overflow in multipart file upload

    For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_service_pack_2_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373309
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2379374
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13685.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-48989
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-48989
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-48989
  • article
    https://kb.cert.org/vuls/id/767506
  • article
    https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.44
  • report
    https://access.redhat.com/security/cve/CVE-2025-52520
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-52520
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-52520
  • article
    https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5