Skip to content
OpenAdvisories
Critical RHSA-2026:96228 11 CVEs

Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.6 release and security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 42

ReleasePackageFixed in
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-mod_cluster 0:2.0.5-1.Final_redhat_00001.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-mod_cluster-tomcat 0:2.0.5-1.Final_redhat_00001.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat 0:10.1.49-18.redhat_00018.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-admin-webapps 0:10.1.49-18.redhat_00018.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-docs-webapp 0:10.1.49-18.redhat_00018.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-el-5.0-api 0:10.1.49-18.redhat_00018.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-javadoc 0:10.1.49-18.redhat_00018.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-jsp-3.1-api 0:10.1.49-18.redhat_00018.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-lib 0:10.1.49-18.redhat_00018.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-native 0:1.3.6-2.redhat_2.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-native-debuginfo 0:1.3.6-2.redhat_2.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-selinux 0:10.1.49-18.redhat_00018.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-servlet-6.0-api 0:10.1.49-18.redhat_00018.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el10 jws6-tomcat-webapps 0:10.1.49-18.redhat_00018.1.el10jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-mod_cluster 0:2.0.5-1.Final_redhat_00001.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-mod_cluster-tomcat 0:2.0.5-1.Final_redhat_00001.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat 0:10.1.49-18.redhat_00018.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-admin-webapps 0:10.1.49-18.redhat_00018.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-docs-webapp 0:10.1.49-18.redhat_00018.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-el-5.0-api 0:10.1.49-18.redhat_00018.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-javadoc 0:10.1.49-18.redhat_00018.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-jsp-3.1-api 0:10.1.49-18.redhat_00018.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-lib 0:10.1.49-18.redhat_00018.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-native 0:1.3.6-2.redhat_2.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-native-debuginfo 0:1.3.6-2.redhat_2.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-selinux 0:10.1.49-18.redhat_00018.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-servlet-6.0-api 0:10.1.49-18.redhat_00018.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el8 jws6-tomcat-webapps 0:10.1.49-18.redhat_00018.1.el8jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-mod_cluster 0:2.0.5-1.Final_redhat_00001.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-mod_cluster-tomcat 0:2.0.5-1.Final_redhat_00001.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat 0:10.1.49-18.redhat_00018.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-admin-webapps 0:10.1.49-18.redhat_00018.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-docs-webapp 0:10.1.49-18.redhat_00018.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-el-5.0-api 0:10.1.49-18.redhat_00018.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-javadoc 0:10.1.49-18.redhat_00018.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-jsp-3.1-api 0:10.1.49-18.redhat_00018.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-lib 0:10.1.49-18.redhat_00018.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-native 0:1.3.6-2.redhat_2.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-native-debuginfo 0:1.3.6-2.redhat_2.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-selinux 0:10.1.49-18.redhat_00018.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-servlet-6.0-api 0:10.1.49-18.redhat_00018.1.el9jws
Red Hat · JBoss Web Server 6 jboss_enterprise_web_server:6.2::el9 jws6-tomcat-webapps 0:10.1.49-18.redhat_00018.1.el9jws

Vulnerabilities 11

  • Critical 9.8
    CVE-2026-76183 Public exploit

    Apache Tomcat: Bypass of security constraints for WebSocket endpoints

    Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 …

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu
  • Critical 9.8
    CVE-2026-86248

    Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Us…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu
  • Critical 9.1
    CVE-2026-86246

    Apache Tomcat Native: Insecure OpenSSL options enabled

    Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apa…

    Apache Software Foundation Apache Tomcat Native tomcat-native tomcat-native Debian Ubuntu Alpine
  • Critical 9.1
    CVE-2026-86350 Public exploit

    Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

    Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.2…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 7.5
    CVE-2026-77791

    Apache Tomcat: DoS via busy wait during WebSocket close

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The fo…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 7.5
    CVE-2026-78383

    Apache Tomcat: AJP DoS via missing request body

    Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 7.5
    CVE-2026-79677

    Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout

    Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 th…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 7.5
    CVE-2026-86243

    Apache Tomcat Native: DoS via TLS handshake

    Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versi…

    Apache Software Foundation Apache Tomcat Native tomcat-native tomcat-native Debian Ubuntu Alpine
  • High 7.4
    CVE-2026-86247

    Apache Tomcat Native: Client certificate requirements can be down-graded

    Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. …

    Apache Software Foundation Apache Tomcat Native tomcat-native tomcat-native Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-73581

    Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore

    Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 throu…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • Medium 4.3
    CVE-2026-76166

    Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram

    A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a Nul…

    Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 7

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.2/html/red_hat_jboss_web_server_6.2_service_pack_6_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510883
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539355
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539356
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539370
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539393
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539394
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539395
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539396
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539486
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539616
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542847
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_96228.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-73581
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-73581
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-73581
  • article
    https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do
  • report
    https://access.redhat.com/security/cve/CVE-2026-76166
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-76166
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-76166
  • report
    https://access.redhat.com/security/cve/CVE-2026-76183
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-76183
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-76183
  • article
    https://lists.apache.org/thread/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp
  • report
    https://access.redhat.com/security/cve/CVE-2026-77791
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-77791
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-77791
  • article
    https://lists.apache.org/thread/mb1pjjooqytrl6hbvbt3rw1lqwlon4cz
  • report
    https://access.redhat.com/security/cve/CVE-2026-78383
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-78383
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-78383
  • article
    https://lists.apache.org/thread/tyqcqk99g7ghgk22641vf67vghcyswnw
  • report
    https://access.redhat.com/security/cve/CVE-2026-79677
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-79677
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-79677
  • article
    http://www.openwall.com/lists/oss-security/2026/09/23/27
  • article
    https://lists.apache.org/thread/bzwps6ck4szf2hmksbbon3syyl9qnkv8
  • report
    https://access.redhat.com/security/cve/CVE-2026-86243