Red Hat Security AdvisoryRHSA-2026:39188
Red Hat JBoss Web Server 7.0.0 security release
Released 2026-07-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Web Server 7.0 on RHEL 10 jws7-tomcat-11.0.21-5.redhat_00004.1.el10jws, jws7-tomcat-admin-webapps-11.0.21-5.redhat_00004.1.el10jws, jws7-tomcat-docs-webapp-11.0.21-5.redhat_00004.1.el10jws +7
- Red Hat JBoss Web Server 7.0 on RHEL 8 jws7-tomcat-11.0.21-5.redhat_00004.1.el8jws, jws7-tomcat-admin-webapps-11.0.21-5.redhat_00004.1.el8jws, jws7-tomcat-docs-webapp-11.0.21-5.redhat_00004.1.el8jws +7
- Red Hat JBoss Web Server 7.0 on RHEL 9 jws7-tomcat-11.0.21-5.redhat_00004.1.el9jws, jws7-tomcat-admin-webapps-11.0.21-5.redhat_00004.1.el9jws, jws7-tomcat-docs-webapp-11.0.21-5.redhat_00004.1.el9jws +7
Fixes 10 records
Priority CRITICAL 90KEV
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.98503 · Published 2026-04-09 · Partial fix · 11.0.21, 10.1.54 +1 CWE-311
Priority MEDIUM 52
DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01326 · Published 2026-05-12 · Partial fix · 9.0.118, 10.1.55 +1 CWE-592
Priority MEDIUM 52
Improper Input Validation vulnerability in Apache Tomcat.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01705 · Published 2026-05-12 · Partial fix · 9.0.118, 10.1.55 +1 CWE-20
Priority MEDIUM 50
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01221 · Published 2026-05-12 · Partial fix · 9.0.118, 10.1.55 +1 CWE-285
Priority MEDIUM 50
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0885 · Published 2026-04-09 · Partial fix · 9.0.116, 10.1.53 +1 CWE-209
Priority MEDIUM 40
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00839 · Published 2026-05-12 · Partial fix · 9.0.118, 10.1.55 +1 CWE-770
Priority LOW 39
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00503 · Published 2026-05-12 · Partial fix · 9.0.118, 10.1.55 +1 CWE-178
Priority LOW 39
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00691 · Published 2026-05-12 · Partial fix · 9.0.118, 10.1.55 +1 CWE-200
Priority LOW 36
Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00695 · Published 2026-06-29 · Partial fix · 11.0.23, 10.1.56 +1 CWE-285
Priority LOW 18
Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00352 · Published 2026-05-12 · Partial fix · 9.0.118, 10.1.55 +1 CWE-208
THREATIST.IORead the docs