RHSA-2026:39188HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.0 security release

Published
July 14, 2026
Last Modified
August 29, 2026

🔗 CVE IDs covered (10)

CVE-2026-29146 →CVE-2026-34486 →CVE-2026-41293 →CVE-2026-43512 →CVE-2026-43513 →CVE-2026-55956 →CVE-2026-41284 →CVE-2026-42498 →CVE-2026-43514 →CVE-2026-43515 →

📋 Description

CVE-2026-29146 — Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-34486 — Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass CVE-2026-41284 — tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation CVE-2026-41293 — tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-42498 — tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. CVE-2026-43512 — tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43513 — tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm CVE-2026-43514 — tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy CVE-2026-43515 — tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-55956 — tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

🎯 Affected products93

  • Red Hat JBoss Web Server 7.0 on RHEL 10
  • Red Hat JBoss Web Server 7.0 on RHEL 8
  • Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-build-0:1-1.el10jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-build-0:1-1.el8jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-build-0:1-1.el9jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-ecj-0:4.38.0-1.redhat_00001.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-ecj-0:4.38.0-1.redhat_00001.1.el10jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-ecj-0:4.38.0-1.redhat_00001.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-ecj-0:4.38.0-1.redhat_00001.1.el8jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-ecj-0:4.38.0-1.redhat_00001.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-ecj-0:4.38.0-1.redhat_00001.1.el9jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-javapackages-filesystem-0:6.0.0-1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-javapackages-filesystem-0:6.0.0-1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-javapackages-filesystem-0:6.0.0-1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-javapackages-tools-0:6.0.0-1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-javapackages-tools-0:6.0.0-1.el10jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-javapackages-tools-0:6.0.0-1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-javapackages-tools-0:6.0.0-1.el8jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-javapackages-tools-0:6.0.0-1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-javapackages-tools-0:6.0.0-1.el9jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-jboss-logging-0:3.6.2-1.Final_redhat_00001.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-jboss-logging-0:3.6.2-1.Final_redhat_00001.1.el10jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-jboss-logging-0:3.6.2-1.Final_redhat_00001.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-jboss-logging-0:3.6.2-1.Final_redhat_00001.1.el8jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-jboss-logging-0:3.6.2-1.Final_redhat_00001.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-jboss-logging-0:3.6.2-1.Final_redhat_00001.1.el9jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-mod_cluster-0:2.1.0-1.Final_redhat_00001.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-mod_cluster-0:2.1.0-1.Final_redhat_00001.1.el10jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-mod_cluster-0:2.1.0-1.Final_redhat_00001.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • +63 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: This vulnerability can be mitigated by removing the affected jar file from the tomcat installation. It can be achieved by running the following command as root: ~~~ systemctl stop tomcat rm -fv /usr/share/java/tomcat/catalina-tribes.jar systemctl start tomcat ~~~ It's important to notice if the Tomcat instance is configured to run with clustering, this may lead to errors when restarting the tomcat service. Red Hat's distributed Apache Tomcat should not be run with Clustering enabled, so make sure to disable such configuration before proceed with the mitigation if that's the case. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, disable DIGEST authentication within Apache Tomcat if it is not essential for your environment. This involves modifying the server's authentication configuration to utilize alternative methods or remove the DIGEST realm. A service restart is required for these changes to take effect and may impact functionality relying on DIGEST authentication. Workaround: This vulnerability only affects Tomcat deployments using the LockOutRealm with a case-insensitive authentication backend. Deployments not using LockOutRealm or using case-sensitive authentication backends are not affected. Workaround: Review your application's web.xml file. Ensure security constraints explicitly deny unauthorized users by path, rather than relying strictly on filtering specific HTTP methods (like GET or POST).

🔗 References (14)