Red Hat Security Advisory

RHSA-2026:20405

Red Hat JBoss Web Server 6.2.3 release and security update

Released 2026-05-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 6.2 on RHEL 10 jws6-tomcat-10.1.49-13.redhat_00011.1.el10jws, jws6-tomcat-admin-webapps-10.1.49-13.redhat_00011.1.el10jws, jws6-tomcat-docs-webapp-10.1.49-13.redhat_00011.1.el10jws +7
Red Hat JBoss Web Server 6.2 on RHEL 8 jws6-tomcat-10.1.49-13.redhat_00011.1.el8jws, jws6-tomcat-admin-webapps-10.1.49-13.redhat_00011.1.el8jws, jws6-tomcat-docs-webapp-10.1.49-13.redhat_00011.1.el8jws +7
Red Hat JBoss Web Server 6.2 on RHEL 9 jws6-tomcat-10.1.49-13.redhat_00011.1.el9jws, jws6-tomcat-admin-webapps-10.1.49-13.redhat_00011.1.el9jws, jws6-tomcat-docs-webapp-10.1.49-13.redhat_00011.1.el9jws +7

Fixes 7 records

TI-2026-23284 CVE-2026-29146 · GHSA-h468-7pvh-8vr8

Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

MEDIUM 50

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0885 Published 2026-04-09 Partial fix · 9.0.116, 10.1.53 +1 CWE-209

TI-2026-23283 CVE-2026-29145 · GHSA-95jq-rwvf-vjx4

Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

MEDIUM 46

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00727 Published 2026-04-09 Partial fix · 9.0.116, 10.1.53 +1 CWE-287

TI-2026-20066 CVE-2026-24880 · GHSA-563x-q5rq-57qp

Apache Tomcat: Request smuggling via invalid chunk extension

MEDIUM 40

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00709 Published 2026-04-09 Partial fix · 9.0.116, 10.1.52 +1 CWE-444

TI-2026-26742 CVE-2026-34487 · GHSA-x4m4-345f-5h5g

Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

LOW 39

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00455 Published 2026-04-09 Partial fix · 9.0.117, 10.1.54 +1 CWE-532

TI-2026-26740 CVE-2026-34483 · GHSA-rv64-5gf8-9qq8

Apache Tomcat: Incomplete escaping of JSON access logs

LOW 39

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00469 Published 2026-04-09 Partial fix · 9.0.116, 10.1.54 +1 CWE-116

TI-2026-26752 CVE-2026-34500 · GHSA-24j9-x2wg-9qv6

Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

LOW 29

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00458 Published 2026-04-09 Partial fix · 9.0.117, 10.1.54 +1 CWE-287

TI-2026-20898 CVE-2026-25854 · GHSA-9m3c-qcxr-9x87

Apache Tomcat: Occasionally open redirect

LOW 28

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00582 Published 2026-04-09 Partial fix · 9.0.116, 10.1.53 +1 CWE-601