Red Hat Security Advisory

RHSA-2025:11742

Red Hat JBoss Web Server 6.1.1 release and security update

Released 2025-07-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 6.1.1

Fixes 4 records

TI-2025-31104 CVE-2025-48976 · GHSA-vv7r-c36w-3prj

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

MEDIUM 64

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.32877 Published 2025-06-16 Partial fix · 1.6, 2.0.0-M4 +1 CWE-770

TI-2025-31116 CVE-2025-48988 · GHSA-h3gc-qfqq-6h8f

Apache Tomcat: FileUpload large number of parts with headers DoS

MEDIUM 62

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.30433 Published 2025-06-16 Partial fix · 11.0.8, 10.1.42 +1 CWE-770

TI-2025-31206 CVE-2025-49125 · GHSA-wc4r-xq3c-5cf3

Apache Tomcat: Security constraint bypass for pre/post-resources

MEDIUM 45

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03437 Published 2025-06-16 Partial fix · 11.0.8, 10.1.42 +1 CWE-288

TI-2025-33451 CVE-2025-53506 · GHSA-25xr-qj8w-c4vf

Apache Tomcat: DoS via excessive h2 streams at connection start

MEDIUM 43

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02129 Published 2025-07-10 Partial fix · 11.0.9, 10.1.43 +1 CWE-400