Red Hat Security Advisory

RHSA-2026:49951

Red Hat JBoss Web Server 7.0.1 release and security update

Released 2026-08-05 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss Web Server 7.0 on RHEL 10 jws7-tomcat-11.0.21-6.redhat_00005.1.el10jws, jws7-tomcat-admin-webapps-11.0.21-6.redhat_00005.1.el10jws, jws7-tomcat-docs-webapp-11.0.21-6.redhat_00005.1.el10jws +7
Red Hat JBoss Web Server 7.0 on RHEL 8 jws7-tomcat-11.0.21-6.redhat_00005.1.el8jws, jws7-tomcat-admin-webapps-11.0.21-6.redhat_00005.1.el8jws, jws7-tomcat-docs-webapp-11.0.21-6.redhat_00005.1.el8jws +7
Red Hat JBoss Web Server 7.0 on RHEL 9 jws7-tomcat-11.0.21-6.redhat_00005.1.el9jws, jws7-tomcat-admin-webapps-11.0.21-6.redhat_00005.1.el9jws, jws7-tomcat-docs-webapp-11.0.21-6.redhat_00005.1.el9jws +7

Fixes 4 records

TI-2026-42263 CVE-2026-59083 · GHSA-hcjr-322h-429r

Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

MEDIUM 48

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00522 Published 2026-07-14 Partial fix CWE-177

TI-2026-39931 CVE-2026-55276 · GHSA-mqg3-r7h5-24x4

Apache Tomcat: Logged effective web.xml is incomplete

MEDIUM 48

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00607 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-670

TI-2026-38516 CVE-2026-53434 · GHSA-4x29-79gh-6v8q

Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

MEDIUM 48

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00586 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-390

TI-2026-38490 CVE-2026-53404 · GHSA-h792-v28v-ppgr

Apache Tomcat: Bad ornext processing in RewriteValve

LOW 39

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00699 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-670