RHSA-2026:93622HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.3 release and security update

Published
November 3, 2026
Last Modified
November 6, 2026

🔗 CVE IDs covered (11)

CVE-2026-86248 →CVE-2026-73581 →CVE-2026-77791 →CVE-2026-86350 →CVE-2026-76166 →CVE-2026-76183 →CVE-2026-78383 →CVE-2026-79677 →CVE-2026-86243 →CVE-2026-86246 →CVE-2026-86247 →

📋 Description

CVE-2026-73581 — tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists CVE-2026-76166 — modcluster-core: mod_cluster Advertise Listener: unauthenticated DoS via crafted multicast datagram CVE-2026-76183 — tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints CVE-2026-77791 — tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close CVE-2026-78383 — tomcat: Apache Tomcat: Denial of Service via AJP request CVE-2026-79677 — tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts CVE-2026-86243 — tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake CVE-2026-86246 — tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration CVE-2026-86247 — tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition CVE-2026-86248 — tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled CVE-2026-86350 — tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up

🎯 Affected products1

  • Red Hat JBoss Web Server 7.0.3

✅ Remediation

Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files. The References section of this erratum contains a download link for the update. You must be logged in to download the update. Workaround: Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available. Workaround: Disable multicast-based proxy advertisement and use static proxy configuration instead. When advertisement must be enabled, ensure the multicast network segment (default 224.0.1.105:23364) is properly isolated and not accessible from untrusted network segments. Workaround: This issue can be mitigated by disabling AJP connector or restricting access to it to only trusted AJP clients. Workaround: Upgrade Apache Tomcat Native to version 1.3.9 or 2.0.16, as appropriate for the version line. For Red Hat JBoss Web Server, apply the corresponding Red Hat update for the affected stream when available. The Apache advisory does not specify an alternate workaround. Workaround: Upgrade Apache Tomcat Native to version 1.3.9 or 2.0.16, as applicable. For JBoss Web Server, apply the corresponding Red Hat security update when available. Apache’s advisory does not list an alternative workaround. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (15)