Red Hat Security Advisory

RHSA-2026:39189

Red Hat JBoss Web Server 7.0.0 security release

Released 2026-07-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 7.0.0

Fixes 11 records

TI-2026-26741 CVE-2026-34486 · GHSA-69r9-qgr7-g2wj

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

CRITICAL 90KEV

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.98503 Published 2026-04-09 Partial fix · 11.0.21, 10.1.54 +1 CWE-311

TI-2026-31686 CVE-2026-43512 · GHSA-h6fc-48rj-7qqh

Apache Tomcat: Digest authenticator will authenticate any unknown user

MEDIUM 52

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01326 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-592

TI-2026-29896 CVE-2026-41293 · GHSA-r29c-68gh-xp6x

Apache Tomcat: HTTP/2 request headers not validated

MEDIUM 52

Improper Input Validation vulnerability in Apache Tomcat.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01705 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-20

TI-2026-31689 CVE-2026-43515 · GHSA-5m62-pw8w-7w9f

Apache Tomcat: Security constraints not correctly applied

MEDIUM 50

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01221 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-285

TI-2026-23284 CVE-2026-29146 · GHSA-h468-7pvh-8vr8

Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

MEDIUM 50

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0885 Published 2026-04-09 Partial fix · 9.0.116, 10.1.53 +1 CWE-209

TI-2026-29890 CVE-2026-41284 · GHSA-gx5v-xp9w-j4cg

Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

MEDIUM 40

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00839 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-770

TI-2026-31687 CVE-2026-43513 · GHSA-5mp6-jrq3-r938

Apache Tomcat: LockOutRealm treats user names as case-sensitive

LOW 39

Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00503 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-178

TI-2026-30781 CVE-2026-42498 · GHSA-fv25-8xcx-gqjc

Apache Tomcat: WebSocket authentication header exposure

LOW 39

Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00691 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-200

TI-2026-40362 CVE-2026-55956 · GHSA-5v3h-fjv2-54fg

Apache Tomcat: Security constraints for default servlet ignored method

LOW 36

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00695 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-285

TI-2026-02285 CVE-2026-2673 · GHSA-wj64-gh9j-xm82

OpenSSL TLS 1.3 server may choose unexpected key agreement group

LOW 35

Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00453 Published 2026-03-13 Partial fix · 3.6.2, 3.5.6 CWE-757

TI-2026-31688 CVE-2026-43514 · GHSA-9m89-8frq-c98c

Apache Tomcat: AJP secret compared in non-constant time

LOW 18

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00352 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-208