RHSA-2026:43401HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.4 release and security update

Published
July 22, 2026
Last Modified
August 29, 2026

🔗 CVE IDs covered (9)

CVE-2026-42498 →CVE-2026-43512 →CVE-2026-43513 →CVE-2026-53404 →CVE-2026-55956 →CVE-2026-41284 →CVE-2026-41293 →CVE-2026-43514 →CVE-2026-43515 →

📋 Description

CVE-2026-41284 — tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation CVE-2026-41293 — tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-42498 — tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. CVE-2026-43512 — tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43513 — tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm CVE-2026-43514 — tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy CVE-2026-43515 — tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-53404 — Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing CVE-2026-55956 — tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

🎯 Affected products36

  • Red Hat JBoss Web Server 6.2 on RHEL 10
  • Red Hat JBoss Web Server 6.2 on RHEL 8
  • Red Hat JBoss Web Server 6.2 on RHEL 9
  • jws6-tomcat-0:10.1.49-15.redhat_00013.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10
  • jws6-tomcat-0:10.1.49-15.redhat_00013.1.el10jws.src as a component of Red Hat JBoss Web Server 6.2 on RHEL 10
  • jws6-tomcat-0:10.1.49-15.redhat_00013.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8
  • jws6-tomcat-0:10.1.49-15.redhat_00013.1.el8jws.src as a component of Red Hat JBoss Web Server 6.2 on RHEL 8
  • jws6-tomcat-0:10.1.49-15.redhat_00013.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9
  • jws6-tomcat-0:10.1.49-15.redhat_00013.1.el9jws.src as a component of Red Hat JBoss Web Server 6.2 on RHEL 9
  • jws6-tomcat-admin-webapps-0:10.1.49-15.redhat_00013.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10
  • jws6-tomcat-admin-webapps-0:10.1.49-15.redhat_00013.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8
  • jws6-tomcat-admin-webapps-0:10.1.49-15.redhat_00013.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9
  • jws6-tomcat-docs-webapp-0:10.1.49-15.redhat_00013.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10
  • jws6-tomcat-docs-webapp-0:10.1.49-15.redhat_00013.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8
  • jws6-tomcat-docs-webapp-0:10.1.49-15.redhat_00013.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9
  • jws6-tomcat-el-5.0-api-0:10.1.49-15.redhat_00013.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10
  • jws6-tomcat-el-5.0-api-0:10.1.49-15.redhat_00013.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8
  • jws6-tomcat-el-5.0-api-0:10.1.49-15.redhat_00013.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9
  • jws6-tomcat-javadoc-0:10.1.49-15.redhat_00013.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10
  • jws6-tomcat-javadoc-0:10.1.49-15.redhat_00013.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8
  • jws6-tomcat-javadoc-0:10.1.49-15.redhat_00013.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9
  • jws6-tomcat-jsp-3.1-api-0:10.1.49-15.redhat_00013.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10
  • jws6-tomcat-jsp-3.1-api-0:10.1.49-15.redhat_00013.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8
  • jws6-tomcat-jsp-3.1-api-0:10.1.49-15.redhat_00013.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9
  • jws6-tomcat-lib-0:10.1.49-15.redhat_00013.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10
  • jws6-tomcat-lib-0:10.1.49-15.redhat_00013.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8
  • jws6-tomcat-lib-0:10.1.49-15.redhat_00013.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9
  • jws6-tomcat-selinux-0:10.1.49-15.redhat_00013.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10
  • jws6-tomcat-selinux-0:10.1.49-15.redhat_00013.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8
  • jws6-tomcat-selinux-0:10.1.49-15.redhat_00013.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9
  • +6 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, disable DIGEST authentication within Apache Tomcat if it is not essential for your environment. This involves modifying the server's authentication configuration to utilize alternative methods or remove the DIGEST realm. A service restart is required for these changes to take effect and may impact functionality relying on DIGEST authentication. Workaround: This vulnerability only affects Tomcat deployments using the LockOutRealm with a case-insensitive authentication backend. Deployments not using LockOutRealm or using case-sensitive authentication backends are not affected. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: This vulnerability only affects Tomcat deployments that use the RewriteValve with OR-chained rewrite conditions. Deployments that do not use the RewriteValve are not affected. Review rewrite rules for OR-chained conditions and test rule evaluation behavior. Workaround: Review your application's web.xml file. Ensure security constraints explicitly deny unauthorized users by path, rather than relying strictly on filtering specific HTTP methods (like GET or POST).

🔗 References (13)