Read the docs
Red Hat Security Advisory

RHSA-2026:43402

Red Hat JBoss Web Server 6.2.4 release and security update

Released 2026-07-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 10 records

TI-2026-29896 CVE-2026-41293 · GHSA-r29c-68gh-xp6x

Apache Tomcat: HTTP/2 request headers not validated

Priority MEDIUM 52

Improper Input Validation vulnerability in Apache Tomcat.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01705 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-20
TI-2026-31689 CVE-2026-43515 · GHSA-5m62-pw8w-7w9f

Apache Tomcat: Security constraints not correctly applied

Priority MEDIUM 50

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01221 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-285
TI-2026-38490 CVE-2026-53404 · GHSA-h792-v28v-ppgr

Apache Tomcat: Bad ornext processing in RewriteValve

Priority LOW 39

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00699 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-670
TI-2026-30781 CVE-2026-42498 · GHSA-fv25-8xcx-gqjc

Apache Tomcat: WebSocket authentication header exposure

Priority LOW 39

Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00691 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-200
TI-2026-40362 CVE-2026-55956 · GHSA-5v3h-fjv2-54fg

Apache Tomcat: Security constraints for default servlet ignored method

Priority LOW 36

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00695 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-285
TI-2026-02285 CVE-2026-2673 · GHSA-wj64-gh9j-xm82

OpenSSL TLS 1.3 server may choose unexpected key agreement group

Priority LOW 35

Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00453 Published 2026-03-13 Partial fix · 3.6.2, 3.5.6 CWE-757
TI-2026-31688 CVE-2026-43514 · GHSA-9m89-8frq-c98c

Apache Tomcat: AJP secret compared in non-constant time

Priority LOW 18

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00352 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-208