Red Hat JBoss Web Server 7.0.0 is a fully integrated Java web application hosting platform including Apache Tomcat and related components. This release addresses several security vulnerabilities including CVE-2026-29146 (padding oracle information disclosure in EncryptInterceptor), CVE-2026-34486 (missing encryption due to EncryptInterceptor bypass), CVE-2026-43515 (improper authorization allowing security bypass), CVE-2026-41284 (denial of service via uncontrolled resource allocation), CVE-2026-41293 (HTTP/2 request headers not validated), CVE-2026-42498 (information disclosure via HTTP Authentication header exposure during WebSocket authentication), CVE-2026-43512 (authentication bypass via digest authentication), CVE-2026-43513 (improper handling of case sensitivity in LockOutRealm), CVE-2026-43514 (information disclosure via AJP secret timing discrepancy), and CVE-2026-55956 (improper authorization allowing security constraint bypass). These issues impact confidentiality and authorization controls. The update replaces Red Hat JBoss Web Server 6.2.3 and is available for RHEL 8, 9, and 10 platforms.

The vulnerabilities collectively allow attackers to bypass encryption, disclose sensitive information, bypass authentication and authorization controls, and cause denial of service conditions. This can lead to unauthorized access to sensitive data and security constraints, potentially compromising the confidentiality and integrity of hosted Java web applications.

Red Hat has released Red Hat JBoss Web Server 7.0.0 as a security update that addresses these vulnerabilities. Users should upgrade to this version to remediate the issues. Before applying this update, ensure all previously released errata relevant to your system have been applied. Follow the official Red Hat guidance for applying the update: https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.