RHSA-2026:49951MediumCVSS 6.5

Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.1 release and security update

Published
August 5, 2026
Last Modified
August 6, 2026

🔗 CVE IDs covered (4)

CVE-2026-53404 →CVE-2026-53434 →CVE-2026-55276 →CVE-2026-59083 →

📋 Description

CVE-2026-53404 — Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing CVE-2026-53434 — tomcat: Apache Tomcat: Error condition not handled when configuring CRLs CVE-2026-55276 — tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow CVE-2026-59083 — tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

🎯 Affected products36

  • Red Hat JBoss Web Server 7.0 on RHEL 10
  • Red Hat JBoss Web Server 7.0 on RHEL 8
  • Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10
  • jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8
  • jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9
  • +6 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: This vulnerability only affects Tomcat deployments that use the RewriteValve with OR-chained rewrite conditions. Deployments that do not use the RewriteValve are not affected. Review rewrite rules for OR-chained conditions and test rule evaluation behavior. Workaround: This vulnerability only affects Tomcat deployments using the FFM-based connector (requires Java 22+) with CRL-based certificate revocation checking. Deployments using the standard NIO/NIO2 connectors or not using CRL checking are not affected. Workaround: This is a logging-only issue with no runtime security impact. No mitigation is required. Administrators should not rely solely on the effective web.xml debug log output to verify security constraint configuration. Workaround: To mitigate this issue, review Apache Tomcat's rewrite valve configurations. If the rewrite valve is not essential for your application, consider disabling it. If it is required, ensure its configuration does not permit improper URL encoding that could lead to security constraint bypasses. A service restart may be required for changes to take effect.

🔗 References (8)