RHSA-2026:39189HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.0 security release

Published
July 14, 2026
Last Modified
August 29, 2026

🔗 CVE IDs covered (11)

CVE-2026-2673 →CVE-2026-34486 →CVE-2026-43512 →CVE-2026-43513 →CVE-2026-43514 →CVE-2026-43515 →CVE-2026-55956 →CVE-2026-29146 →CVE-2026-41284 →CVE-2026-41293 →CVE-2026-42498 →

📋 Description

CVE-2026-2673 — openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group CVE-2026-29146 — Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-34486 — Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass CVE-2026-41284 — tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation CVE-2026-41293 — tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-42498 — tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. CVE-2026-43512 — tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43513 — tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm CVE-2026-43514 — tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy CVE-2026-43515 — tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-55956 — tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

🎯 Affected products1

  • Red Hat JBoss Web Server 7.0.0

✅ Remediation

Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files. The References section of this erratum contains a download link for the update. You must be logged in to download the update. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: This vulnerability can be mitigated by removing the affected jar file from the tomcat installation. It can be achieved by running the following command as root: ~~~ systemctl stop tomcat rm -fv /usr/share/java/tomcat/catalina-tribes.jar systemctl start tomcat ~~~ It's important to notice if the Tomcat instance is configured to run with clustering, this may lead to errors when restarting the tomcat service. Red Hat's distributed Apache Tomcat should not be run with Clustering enabled, so make sure to disable such configuration before proceed with the mitigation if that's the case. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, disable DIGEST authentication within Apache Tomcat if it is not essential for your environment. This involves modifying the server's authentication configuration to utilize alternative methods or remove the DIGEST realm. A service restart is required for these changes to take effect and may impact functionality relying on DIGEST authentication. Workaround: This vulnerability only affects Tomcat deployments using the LockOutRealm with a case-insensitive authentication backend. Deployments not using LockOutRealm or using case-sensitive authentication backends are not affected. Workaround: Review your application's web.xml file. Ensure security constraints explicitly deny unauthorized users by path, rather than relying strictly on filtering specific HTTP methods (like GET or POST).

🔗 References (15)