This Red Hat Security Advisory covers the release of Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 1, which replaces version 2.4.62 and includes multiple security fixes. The fixed vulnerabilities include CVE-2024-8176 (improper restriction of XML entity expansion depth in libexpat), CVE-2025-49812 (HTTP session hijack via TLS upgrade), CVE-2025-23048 (access control bypass via TLS 1.3 session resumption), CVE-2024-47252 (insufficient escaping of user data in mod_ssl), CVE-2025-49630 (assertion failure from untrusted input in mod_proxy_http2), CVE-2025-32414 and CVE-2025-32415 (out-of-bounds reads in libxml2), and CVE-2025-47947 (possible denial-of-service in ModSecurity). The advisory is rated as important by Red Hat and applies to Red Hat JBoss Core Services and related middleware products. The update is intended to improve security and stability by addressing these vulnerabilities. No CVSS scores are provided in the advisory; users should refer to the linked CVE pages for detailed scoring and impact information.

The vulnerabilities fixed in this update could allow attackers to cause denial-of-service conditions, bypass access controls, hijack HTTP sessions, trigger assertion failures, and exploit out-of-bounds memory reads. These issues affect core components used in Red Hat JBoss middleware products, potentially impacting confidentiality, integrity, and availability of services relying on these components. The update mitigates these risks by addressing the underlying security flaws.

Red Hat has released Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 1 to address these vulnerabilities. Users should back up their existing installations, including applications and configurations, before applying the update. The update is available from Red Hat's official channels and should be applied promptly to mitigate the security risks. No indication of 'no action required' or 'already mitigated' is present; therefore, applying the official update is the recommended mitigation.