This advisory covers a security update for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP1, which addresses several vulnerabilities: CVE-2024-8176 in libexpat involving improper restriction of XML entity expansion depth; CVE-2025-49812 allowing HTTP session hijacking via TLS upgrade; CVE-2025-23048 permitting access control bypass through TLS 1.3 session resumption; CVE-2024-47252 related to insufficient escaping of user-supplied data in mod_ssl; CVE-2025-49630 causing assertion failure from untrusted input in mod_proxy_http2; CVE-2025-32414 and CVE-2025-32415 involving out-of-bounds reads in libxml2; and CVE-2025-47947, a possible denial-of-service vulnerability in ModSecurity. The update is distributed as a service pack replacing the previous 2.4.62 release to provide a consistent and faster update experience for Red Hat JBoss middleware products.

The vulnerabilities fixed in this update could allow attackers to cause denial of service, bypass access controls, hijack HTTP sessions, or trigger memory corruption issues. Specifically, improper XML entity expansion can lead to resource exhaustion, session hijacking via TLS upgrade can compromise user sessions, and access control bypass through TLS 1.3 session resumption can allow unauthorized access. Out-of-bounds reads and assertion failures may lead to crashes or information disclosure. These issues collectively pose a significant security risk to systems running affected versions of Red Hat JBoss Core Services Apache HTTP Server.

An official security update is available in Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 1, which replaces version 2.4.62 and includes fixes for all listed vulnerabilities. Users should apply this update promptly following Red Hat's documented procedures, including backing up existing installations and configurations before updating. No additional mitigation steps are indicated beyond applying the official update.