Red Hat Security Advisory

RHSA-2025:22925

Red Hat JBoss Web Server 5.8.6 release and security update

Released 2025-12-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 5.8 for RHEL 7 Server jws5-tomcat-9.0.87-14.redhat_00013.1.el7jws, jws5-tomcat-admin-webapps-9.0.87-14.redhat_00013.1.el7jws, jws5-tomcat-docs-webapp-9.0.87-14.redhat_00013.1.el7jws +9
Red Hat JBoss Web Server 5.8 for RHEL 8 jws5-tomcat-9.0.87-14.redhat_00013.1.el8jws, jws5-tomcat-admin-webapps-9.0.87-14.redhat_00013.1.el8jws, jws5-tomcat-docs-webapp-9.0.87-14.redhat_00013.1.el8jws +7
Red Hat JBoss Web Server 5.8 for RHEL 9 jws5-tomcat-9.0.87-14.redhat_00013.1.el9jws, jws5-tomcat-admin-webapps-9.0.87-14.redhat_00013.1.el9jws, jws5-tomcat-docs-webapp-9.0.87-14.redhat_00013.1.el9jws +7

TI-2025-35172 CVE-2025-55752 · GHSA-wmwf-9ccg-fff5

HIGH 71

Relative Path Traversal vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.64413 Published 2025-10-27 Partial fix · 11.0.11, 10.1.45 +1 CWE-23

TI-2025-22813 CVE-2025-31651 · GHSA-ff77-26x5-69cr

MEDIUM 56

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04263 Published 2025-04-28 Partial fix · 9.0.104, 10.1.40 +1 CWE-116

TI-2025-31117 CVE-2025-48989 · GHSA-gqp3-2cvr-x8m3

MEDIUM 45

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03768 Published 2025-08-13 Partial fix · 11.0.10, 10.1.44 +1 CWE-404