Red Hat Security AdvisoryRHSA-2025:11741
Red Hat JBoss Web Server 6.1.1 release and security update
Released 2025-07-30 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat JBoss Web Server 6.1 for RHEL 10 jws6-tomcat-10.1.36-7.redhat_00008.1.el10jws, jws6-tomcat-admin-webapps-10.1.36-7.redhat_00008.1.el10jws, jws6-tomcat-docs-webapp-10.1.36-7.redhat_00008.1.el10jws +7
- Red Hat JBoss Web Server 6.1 for RHEL 8 jws6-tomcat-10.1.36-7.redhat_00008.1.el8jws, jws6-tomcat-admin-webapps-10.1.36-7.redhat_00008.1.el8jws, jws6-tomcat-docs-webapp-10.1.36-7.redhat_00008.1.el8jws +7
- Red Hat JBoss Web Server 6.1 for RHEL 9 jws6-tomcat-10.1.36-7.redhat_00008.1.el9jws, jws6-tomcat-admin-webapps-10.1.36-7.redhat_00008.1.el9jws, jws6-tomcat-docs-webapp-10.1.36-7.redhat_00008.1.el9jws +7
Fixes 4 records
Priority MEDIUM 64
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.32877 · Published 2025-06-16 · Partial fix · 1.6, 2.0.0-M4 +1 CWE-770
Priority MEDIUM 62
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.30433 · Published 2025-06-16 · Partial fix · 11.0.8, 10.1.42 +1 CWE-770
Priority MEDIUM 45
Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03437 · Published 2025-06-16 · Partial fix · 11.0.8, 10.1.42 +1 CWE-288
Priority MEDIUM 43
Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02129 · Published 2025-07-10 · Partial fix · 11.0.9, 10.1.43 +1 CWE-400
THREATIST.IORead the docs