Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.0 release and security update

Fixed packages 26

Vulnerabilities 3

• Critical 10.0
  CVE-2025-24813 Exploited Public exploit Scanner template EPSS 100%

  Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

  Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 t…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Mar 10, 2025

  KEV Apr 1, 2025
• Critical 9.8
  CVE-2024-52316 Public exploit

  Apache Tomcat: Authentication bypass when using Jakarta Authentication API

  Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an…

  Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  Nov 18, 2024
• High 7.5
  CVE-2025-31650 Public exploit EPSS 61%

  Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

  Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOf…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 28, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2326972
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2351129
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2362783
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3608.json
• report
  https://access.redhat.com/security/cve/CVE-2024-52316
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-52316
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-52316
• article
  https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928
• report
  https://access.redhat.com/security/cve/CVE-2025-24813
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-24813
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-24813
• article
  https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2025-31650
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-31650
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-31650
• article
  https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826