Red Hat Security Advisory

RHSA-2026:2740

Red Hat JBoss Web Server 6.2.0 security release

Released 2026-02-16 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 6.2 on RHEL 10 jws6-tomcat-10.1.49-7.redhat_00006.1.el10jws, jws6-tomcat-admin-webapps-10.1.49-7.redhat_00006.1.el10jws, jws6-tomcat-docs-webapp-10.1.49-7.redhat_00006.1.el10jws +7
Red Hat JBoss Web Server 6.2 on RHEL 8 jws6-tomcat-10.1.49-7.redhat_00006.1.el8jws, jws6-tomcat-admin-webapps-10.1.49-7.redhat_00006.1.el8jws, jws6-tomcat-docs-webapp-10.1.49-7.redhat_00006.1.el8jws +7
Red Hat JBoss Web Server 6.2 on RHEL 9 jws6-tomcat-10.1.49-7.redhat_00006.1.el9jws, jws6-tomcat-admin-webapps-10.1.49-7.redhat_00006.1.el9jws, jws6-tomcat-docs-webapp-10.1.49-7.redhat_00006.1.el9jws +7

Fixes 3 records

TI-2025-35174 CVE-2025-55754 · GHSA-vfww-5hm6-hx2j

Apache Tomcat: console manipulation via escape sequences in log messages

MEDIUM 55

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.10338 Published 2025-10-27 Partial fix · 11.0.11, 10.1.45 +1 CWE-150

TI-2025-29372 CVE-2025-46701 · GHSA-h2fw-rfh5-95r3

Apache Tomcat: Security constraint bypass for CGI scripts

MEDIUM 44

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.03143 Published 2025-05-29 Partial fix · 9.0.105, 10.1.41 +1 CWE-178

TI-2025-35099 CVE-2025-55668 · GHSA-23hv-mwm6-g8jf

Apache Tomcat: session fixation via rewrite valve

LOW 31

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00945 Published 2025-08-13 Partial fix · 11.0.8, 10.1.42 +1 CWE-384