Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.2 release and security update

Fixed packages 30

Vulnerabilities 3

• High 7.6
  CVE-2025-66614

  Apache Tomcat: Client certificate verification bypass due to virtual host mapping

  Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affec…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Feb 17, 2026
• Medium 6.5
  CVE-2026-24733 Public exploit

  Apache Tomcat: Security constraint bypass with HTTP/0.9

  Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET req…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Feb 17, 2026
• Medium 5.3
  CVE-2026-32990

  Apache Tomcat: Fix for CVE-2025-66614 is incomplete

  Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade t…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.2/html/red_hat_jboss_web_server_6.2_service_pack_2_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2440430
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2440437
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457025
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_12194.json
• report
  https://access.redhat.com/security/cve/CVE-2025-66614
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-66614
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-66614
• article
  https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7
• report
  https://access.redhat.com/security/cve/CVE-2026-24733
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-24733
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-24733
• article
  https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f
• report
  https://access.redhat.com/security/cve/CVE-2026-32990
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32990
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32990
• article
  https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7