Read the docs
Red Hat Security Advisory

RHSA-2026:73981

Red Hat JBoss Web Server 6.2.5 release and security update

Released 2026-10-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 13 records

TI-2026-48288 CVE-2026-68525 · GHSA-h3x4-894j-xpx5

Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

Priority MEDIUM 48

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00643 Published 2026-08-25 Partial fix · 11.0.25, 10.1.58 +1 CWE-863
TI-2026-46514 CVE-2026-65182 · GHSA-gcx9-497g-6cp6

Apache Tomcat: Bypass longest prefix security constraint

Priority MEDIUM 48

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-pa…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00654 Published 2026-08-25 Partial fix · 11.0.25, 10.1.58 +1 CWE-284
TI-2026-39931 CVE-2026-55276 · GHSA-mqg3-r7h5-24x4

Apache Tomcat: Logged effective web.xml is incomplete

Priority MEDIUM 48

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00607 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-670
TI-2026-47098 CVE-2026-66299 · GHSA-rpf9-hrjr-88fv

Apache Tomcat: DoS via WebSocket chat example

Priority MEDIUM 40

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00553 Published 2026-07-28 Partial fix CWE-400
TI-2026-46515 CVE-2026-65183 · GHSA-h3mr-2w3q-jcv9

Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets

Priority LOW 37

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00398 Published 2026-08-25 Partial fix · 8.5.0, 7.0.0 CWE-367
TI-2026-47178 CVE-2026-66422 · GHSA-w3xg-786f-g788

Apache Tomcat: Servlet role references can bypass declarative role constraints

Priority LOW 36

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00431 Published 2026-08-25 Partial fix CWE-285
TI-2026-51328 CVE-2026-73180 · GHSA-wrvx-pxxf-g8fg

Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Priority LOW 32

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP se…

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00441 Published 2026-08-25 Partial fix CWE-613