RHSA-2026:49952MediumCVSS 6.5

Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.1 release and security update

Published
August 5, 2026
Last Modified
August 6, 2026

🔗 CVE IDs covered (4)

CVE-2026-53404 →CVE-2026-53434 →CVE-2026-55276 →CVE-2026-59083 →

📋 Description

CVE-2026-53404 — Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing CVE-2026-53434 — tomcat: Apache Tomcat: Error condition not handled when configuring CRLs CVE-2026-55276 — tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow CVE-2026-59083 — tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

🎯 Affected products1

  • Red Hat JBoss Web Server 7.0.1

✅ Remediation

Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files. The References section of this erratum contains a download link for the update. You must be logged in to download the update. Workaround: This vulnerability only affects Tomcat deployments that use the RewriteValve with OR-chained rewrite conditions. Deployments that do not use the RewriteValve are not affected. Review rewrite rules for OR-chained conditions and test rule evaluation behavior. Workaround: This vulnerability only affects Tomcat deployments using the FFM-based connector (requires Java 22+) with CRL-based certificate revocation checking. Deployments using the standard NIO/NIO2 connectors or not using CRL checking are not affected. Workaround: This is a logging-only issue with no runtime security impact. No mitigation is required. Administrators should not rely solely on the effective web.xml debug log output to verify security constraint configuration. Workaround: To mitigate this issue, review Apache Tomcat's rewrite valve configurations. If the rewrite valve is not essential for your application, consider disabling it. If it is required, ensure its configuration does not permit improper URL encoding that could lead to security constraint bypasses. A service restart may be required for changes to take effect.

🔗 References (8)