Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.4 release and security update

Fixed packages 30

Vulnerabilities 9

• Critical 9.8
  CVE-2026-41293 Public exploit

  Apache Tomcat: HTTP/2 request headers not validated

  Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also …

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.8
  CVE-2026-43512 Public exploit

  Apache Tomcat: Digest authenticator will authenticate any unknown user

  DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.1
  CVE-2026-43515 Public exploit

  Apache Tomcat: Security constraints not correctly applied

  Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.11…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.5
  CVE-2026-41284

  Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affec…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.5
  CVE-2026-43513

  Apache Tomcat: LockOutRealm treats user names as case-sensitive

  Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.3
  CVE-2026-42498

  Apache Tomcat: WebSocket authentication header exposure

  Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.2…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.3
  CVE-2026-53404

  Apache Tomcat: Bad ornext processing in RewriteValve

  Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, …

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026
• Medium 6.5
  CVE-2026-55956

  Apache Tomcat: Security constraints for default servlet ignored method

  Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026
• Low 3.7
  CVE-2026-43514

  Apache Tomcat: AJP secret compared in non-constant time

  Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 thr…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.2/html/red_hat_jboss_web_server_6.2_service_pack_4_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476511
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476512
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476516
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476518
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476519
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476520
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494676
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494681
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43401.json
• report
  https://access.redhat.com/security/cve/CVE-2026-41284
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-41284
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-41284
• article
  https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc
• report
  https://access.redhat.com/security/cve/CVE-2026-41293
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-41293
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-41293
• article
  https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r
• report
  https://access.redhat.com/security/cve/CVE-2026-42498
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42498
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42498
• article
  https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb
• report
  https://access.redhat.com/security/cve/CVE-2026-43512
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43512
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43512
• article
  https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73
• report
  https://access.redhat.com/security/cve/CVE-2026-43513
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43513
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43513
• article
  https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp
• report
  https://access.redhat.com/security/cve/CVE-2026-43514
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43514
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43514
• article
  https://lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m
• report
  https://access.redhat.com/security/cve/CVE-2026-43515
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43515
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43515