RHSA-2026:43402HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.4 release and security update

Published
July 22, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (10)

CVE-2026-43512 →CVE-2026-43515 →CVE-2026-41293 →CVE-2026-42498 →CVE-2026-43513 →CVE-2026-43514 →CVE-2026-53404 →CVE-2026-55956 →CVE-2026-2673 →CVE-2026-41284 →

📋 Description

CVE-2026-2673 — openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group CVE-2026-41284 — tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation CVE-2026-41293 — tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-42498 — tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. CVE-2026-43512 — tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43513 — tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm CVE-2026-43514 — tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy CVE-2026-43515 — tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-53404 — Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing CVE-2026-55956 — tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

🎯 Affected products1

  • Red Hat JBoss Web Server 6.2.4

✅ Remediation

Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files. The References section of this erratum contains a download link for the update. You must be logged in to download the update. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, disable DIGEST authentication within Apache Tomcat if it is not essential for your environment. This involves modifying the server's authentication configuration to utilize alternative methods or remove the DIGEST realm. A service restart is required for these changes to take effect and may impact functionality relying on DIGEST authentication. Workaround: This vulnerability only affects Tomcat deployments using the LockOutRealm with a case-insensitive authentication backend. Deployments not using LockOutRealm or using case-sensitive authentication backends are not affected. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: This vulnerability only affects Tomcat deployments that use the RewriteValve with OR-chained rewrite conditions. Deployments that do not use the RewriteValve are not affected. Review rewrite rules for OR-chained conditions and test rule evaluation behavior. Workaround: Review your application's web.xml file. Ensure security constraints explicitly deny unauthorized users by path, rather than relying strictly on filtering specific HTTP methods (like GET or POST).

🔗 References (14)