Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.0 security release

Fixed packages 30

Vulnerabilities 10

• High 7.5
  CVE-2026-34486 Exploited Public exploit Scanner template EPSS 99%

  Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

  Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat org.apache.tomcat:tomcat-tribes Maven
  Apr 9, 2026

  KEV Aug 4, 2026
• Critical 9.8
  CVE-2026-41293 Public exploit

  Apache Tomcat: HTTP/2 request headers not validated

  Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also …

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.8
  CVE-2026-43512 Public exploit

  Apache Tomcat: Digest authenticator will authenticate any unknown user

  DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.1
  CVE-2026-43515 Public exploit

  Apache Tomcat: Security constraints not correctly applied

  Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.11…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.5
  CVE-2026-29146

  Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

  Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026
• High 7.5
  CVE-2026-41284

  Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affec…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.5
  CVE-2026-43513

  Apache Tomcat: LockOutRealm treats user names as case-sensitive

  Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.3
  CVE-2026-42498

  Apache Tomcat: WebSocket authentication header exposure

  Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.2…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Medium 6.5
  CVE-2026-55956

  Apache Tomcat: Security constraints for default servlet ignored method

  Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026
• Low 3.7
  CVE-2026-43514

  Apache Tomcat: AJP secret compared in non-constant time

  Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 thr…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/7.0/html/red_hat_jboss_web_server_7.0_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457020
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457027
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476511
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476512
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476516
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476518
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476519
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476520
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494676
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39188.json
• report
  https://access.redhat.com/security/cve/CVE-2026-29146
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-29146
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-29146
• article
  https://lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w
• report
  https://access.redhat.com/security/cve/CVE-2026-34486
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-34486
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-34486
• article
  https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2026-41284
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-41284
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-41284
• article
  https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc
• report
  https://access.redhat.com/security/cve/CVE-2026-41293
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-41293
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-41293
• article
  https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r
• report
  https://access.redhat.com/security/cve/CVE-2026-42498
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42498
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42498
• article
  https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb
• report
  https://access.redhat.com/security/cve/CVE-2026-43512
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43512
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43512
• article
  https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73
• report
  https://access.redhat.com/security/cve/CVE-2026-43513