Red Hat Security Advisory

RHSA-2026:12195

Red Hat JBoss Web Server 6.2.2 release and security update

Released 2026-04-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 6.2.2

Fixes 4 records

TI-2026-24346 CVE-2026-31790 · GHSA-vgxx-5xj5-q97x

Incorrect Failure Handling in RSA KEM RSASVE Encapsulation

MEDIUM 41

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01049 Published 2026-04-07 Partial fix · 3.6.2, 3.5.6 +3 CWE-754

TI-2025-41013 CVE-2025-66614 · GHSA-fpj8-gq4v-p354

Apache Tomcat: Client certificate verification bypass due to virtual host mapping

LOW 39

Improper Input Validation vulnerability.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00274 Published 2026-02-17 Partial fix · 11.0.15, 10.1.50 +1 CWE-20

TI-2026-25438 CVE-2026-32990 · GHSA-8mc5-53m5-3qj2

Apache Tomcat: Fix for CVE-2025-66614 is incomplete

LOW 30

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00313 Published 2026-04-09 Partial fix · 9.0.116, 10.1.53 +1 CWE-20

TI-2026-19938 CVE-2026-24733 · GHSA-qq5r-98hh-rxc9

Apache Tomcat: Security constraint bypass with HTTP/0.9

LOW 30

Improper Input Validation vulnerability in Apache Tomcat.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00552 Published 2026-02-17 Partial fix · 11.0.15, 10.1.50 +1 CWE-20