RHSA-2026:12194: Moderate: Red Hat JBoss Web Server 6.2.2 release and security update
Moderate: Red Hat JBoss Web Server 6.2.2 release and security update
Other sources
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (modcluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.This release of Red Hat JBoss Web Server 6.2.2 serves as a replacement for Red Hat JBoss Web Server 6.2.1. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.Security Fix(es): tomcat: security constraint bypass with HTTP/0.9 (CVE-2026-24733) tomcat: Client certificate verification bypass due to virtual host mapping (CVE-2025-66614) tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2026:12194?
The severity of RHSA-2026:12194 is classified as moderate.
How do I fix RHSA-2026:12194?
You can fix RHSA-2026:12194 by updating to the appropriate versions of the affected packages, specifically version 10.1.49-10.redhat_00008.1.el10 or its equivalent for other versions.
What software is affected by RHSA-2026:12194?
RHSA-2026:12194 affects Red Hat JBoss Web Server and several related packages including jws6-tomcat and jws6-tomcat-admin-webapps.
Is there a recommended action for users running vulnerable software under RHSA-2026:12194?
Users are recommended to apply updates to their installations of the affected software immediately to mitigate potential risks.
What issues does RHSA-2026:12194 address?
RHSA-2026:12194 addresses security vulnerabilities in the Red Hat JBoss Web Server component, improving overall security compliance.