Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.6 release and security update

Fixed packages 32

Vulnerabilities 3

• Critical 9.8
  CVE-2025-31651 Public exploit

  Apache Tomcat: Bypass of rules in Rewrite Valve

  Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectivel…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 28, 2025
• High 7.5
  CVE-2025-48989

  Apache Tomcat: h2 DoS - Made You Reset

  Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older,…

  Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  Aug 13, 2025
• High 7.5
  CVE-2025-55752 Public exploit EPSS 64%

  Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

  Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the UR…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Oct 27, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html/red_hat_jboss_web_server_5.8_service_pack_6_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2362782
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373309
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2406591
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22925.json
• report
  https://access.redhat.com/security/cve/CVE-2025-31651
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-31651
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-31651
• article
  https://lists.apache.org/list.html?announce@tomcat.apache.org
• report
  https://access.redhat.com/security/cve/CVE-2025-48989
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-48989
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-48989
• article
  https://kb.cert.org/vuls/id/767506
• article
  https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.44
• report
  https://access.redhat.com/security/cve/CVE-2025-55752
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-55752
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-55752
• article
  https://github.com/apache/tomcat/commit/fec06c610ed7466b401e29cc567a58aee5ed826a
• article
  https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog