Skip to content
OpenAdvisories
Critical RHSA-2026:73981 13 CVEs

Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.5 release and security update

Published Oct 2, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 30

ReleasePackageFixed in
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat 0:10.1.49-16.redhat_00016.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-admin-webapps 0:10.1.49-16.redhat_00016.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-docs-webapp 0:10.1.49-16.redhat_00016.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-el-5.0-api 0:10.1.49-16.redhat_00016.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-javadoc 0:10.1.49-16.redhat_00016.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-jsp-3.1-api 0:10.1.49-16.redhat_00016.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-lib 0:10.1.49-16.redhat_00016.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-selinux 0:10.1.49-16.redhat_00016.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-servlet-6.0-api 0:10.1.49-16.redhat_00016.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-webapps 0:10.1.49-16.redhat_00016.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat 0:10.1.49-16.redhat_00016.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-admin-webapps 0:10.1.49-16.redhat_00016.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-docs-webapp 0:10.1.49-16.redhat_00016.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-el-5.0-api 0:10.1.49-16.redhat_00016.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-javadoc 0:10.1.49-16.redhat_00016.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-jsp-3.1-api 0:10.1.49-16.redhat_00016.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-lib 0:10.1.49-16.redhat_00016.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-selinux 0:10.1.49-16.redhat_00016.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-servlet-6.0-api 0:10.1.49-16.redhat_00016.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-webapps 0:10.1.49-16.redhat_00016.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat 0:10.1.49-16.redhat_00016.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-admin-webapps 0:10.1.49-16.redhat_00016.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-docs-webapp 0:10.1.49-16.redhat_00016.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-el-5.0-api 0:10.1.49-16.redhat_00016.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-javadoc 0:10.1.49-16.redhat_00016.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-jsp-3.1-api 0:10.1.49-16.redhat_00016.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-lib 0:10.1.49-16.redhat_00016.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-selinux 0:10.1.49-16.redhat_00016.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-servlet-6.0-api 0:10.1.49-16.redhat_00016.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-webapps 0:10.1.49-16.redhat_00016.1.el9jws

Vulnerabilities 13

  • Critical 9.8
    CVE-2026-65905

    Apache Tomcat: Limited replay attack possible with DIGEST authentication

    Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that …

    Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • Critical 9.1
    CVE-2026-53434

    Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

    Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users ar…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven
  • Critical 9.1
    CVE-2026-55276

    Apache Tomcat: Logged effective web.xml is incomplete

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22,…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  • Critical 9.1
    CVE-2026-59083

    Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

    Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from …

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu
  • Critical 9.1
    CVE-2026-65182

    Apache Tomcat: Bypass longest prefix security constraint

    Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: f…

    Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • Critical 9.1
    CVE-2026-68525

    Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

    Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, fr…

    Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 8.1
    CVE-2026-65183

    Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 8.1
    CVE-2026-66422

    Apache Tomcat: Servlet role references can bypass declarative role constraints

    Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0.0-…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 8.1
    CVE-2026-68569

    Apache Tomcat: Principal lookup can fail open in some cases

    Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 throu…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 7.5
    CVE-2026-65927

    Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

    Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 t…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 7.5
    CVE-2026-66299

    Apache Tomcat: DoS via WebSocket chat example

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guida…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 7.5
    CVE-2026-68763

    Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • Medium 6.8
    CVE-2026-73180

    Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

    Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not …

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.2/html/red_hat_jboss_web_server_6.2_service_pack_5_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2494668
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2494675
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499917
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2508085
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524151
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524153
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524154
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524156
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524160
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524161
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524162
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524165
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524166
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73981.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-53434
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53434
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53434
  • article
    https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk
  • report
    https://access.redhat.com/security/cve/CVE-2026-55276
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-55276
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-55276
  • article
    https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v
  • report
    https://access.redhat.com/security/cve/CVE-2026-59083
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59083
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59083
  • article
    https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq
  • report
    https://access.redhat.com/security/cve/CVE-2026-65182
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65182
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65182
  • article
    https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m
  • report
    https://access.redhat.com/security/cve/CVE-2026-65183
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65183
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65183
  • article
    https://lists.apache.org/thread/748o4st6d5dk6n3l7tgzo5yl68gg05c0
  • report
    https://access.redhat.com/security/cve/CVE-2026-65905
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65905
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65905