Skip to content
OpenAdvisories
Critical RHSA-2026:49951 4 CVEs

Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.1 release and security update

Published Aug 6, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 30

ReleasePackageFixed in
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el10 jws7-tomcat 0:11.0.21-6.redhat_00005.1.el10jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el10 jws7-tomcat-admin-webapps 0:11.0.21-6.redhat_00005.1.el10jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el10 jws7-tomcat-docs-webapp 0:11.0.21-6.redhat_00005.1.el10jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el10 jws7-tomcat-el-5.0-api 0:11.0.21-6.redhat_00005.1.el10jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el10 jws7-tomcat-javadoc 0:11.0.21-6.redhat_00005.1.el10jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el10 jws7-tomcat-jsp-3.1-api 0:11.0.21-6.redhat_00005.1.el10jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el10 jws7-tomcat-lib 0:11.0.21-6.redhat_00005.1.el10jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el10 jws7-tomcat-selinux 0:11.0.21-6.redhat_00005.1.el10jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el10 jws7-tomcat-servlet-6.0-api 0:11.0.21-6.redhat_00005.1.el10jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el10 jws7-tomcat-webapps 0:11.0.21-6.redhat_00005.1.el10jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el8 jws7-tomcat 0:11.0.21-6.redhat_00005.1.el8jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el8 jws7-tomcat-admin-webapps 0:11.0.21-6.redhat_00005.1.el8jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el8 jws7-tomcat-docs-webapp 0:11.0.21-6.redhat_00005.1.el8jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el8 jws7-tomcat-el-5.0-api 0:11.0.21-6.redhat_00005.1.el8jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el8 jws7-tomcat-javadoc 0:11.0.21-6.redhat_00005.1.el8jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el8 jws7-tomcat-jsp-3.1-api 0:11.0.21-6.redhat_00005.1.el8jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el8 jws7-tomcat-lib 0:11.0.21-6.redhat_00005.1.el8jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el8 jws7-tomcat-selinux 0:11.0.21-6.redhat_00005.1.el8jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el8 jws7-tomcat-servlet-6.0-api 0:11.0.21-6.redhat_00005.1.el8jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el8 jws7-tomcat-webapps 0:11.0.21-6.redhat_00005.1.el8jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el9 jws7-tomcat 0:11.0.21-6.redhat_00005.1.el9jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el9 jws7-tomcat-admin-webapps 0:11.0.21-6.redhat_00005.1.el9jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el9 jws7-tomcat-docs-webapp 0:11.0.21-6.redhat_00005.1.el9jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el9 jws7-tomcat-el-5.0-api 0:11.0.21-6.redhat_00005.1.el9jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el9 jws7-tomcat-javadoc 0:11.0.21-6.redhat_00005.1.el9jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el9 jws7-tomcat-jsp-3.1-api 0:11.0.21-6.redhat_00005.1.el9jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el9 jws7-tomcat-lib 0:11.0.21-6.redhat_00005.1.el9jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el9 jws7-tomcat-selinux 0:11.0.21-6.redhat_00005.1.el9jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el9 jws7-tomcat-servlet-6.0-api 0:11.0.21-6.redhat_00005.1.el9jws
Red Hat · JBoss Web Server 7 jboss_enterprise_web_server:7.0::el9 jws7-tomcat-webapps 0:11.0.21-6.redhat_00005.1.el9jws

Vulnerabilities 4

  • Critical 9.1
    CVE-2026-53434

    Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

    Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users ar…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven
  • Critical 9.1
    CVE-2026-55276

    Apache Tomcat: Logged effective web.xml is incomplete

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22,…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven
  • Critical 9.1
    CVE-2026-59083

    Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

    Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from …

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu
  • High 7.3
    CVE-2026-53404

    Apache Tomcat: Bad ornext processing in RewriteValve

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, …

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/7.0/html/red_hat_jboss_web_server_7.0_service_pack_1_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2494668
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2494675
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2494681
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499917
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49951.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-53404
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53404
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53404
  • article
    https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz
  • report
    https://access.redhat.com/security/cve/CVE-2026-53434
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53434
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53434
  • article
    https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk
  • report
    https://access.redhat.com/security/cve/CVE-2026-55276
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-55276
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-55276
  • article
    https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v
  • report
    https://access.redhat.com/security/cve/CVE-2026-59083
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59083
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59083
  • article
    https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq