Red Hat JBoss Web Server 6.2.3 is a security update that replaces version 6.2.2 and addresses seven distinct vulnerabilities in the Apache Tomcat components bundled within the server. The fixed vulnerabilities include HTTP request/response smuggling via invalid chunk extensions (CVE-2026-24880), an open redirect via LoadBalancerDrainingValve (CVE-2026-25854), authentication bypasses due to client certificate misconfigurations (CVE-2026-29145 and CVE-2026-34500), and multiple information disclosure issues including a padding oracle vulnerability in EncryptInterceptor (CVE-2026-29146), improper encoding in JsonAccessLogValve (CVE-2026-34483), and sensitive data exposure in log files (CVE-2026-34487). The update is provided by Red Hat Product Security and is rated as important in severity. No CVSS scores are provided in the advisory, but the vendor rates the impact as important.

The vulnerabilities fixed in this update could allow attackers to perform HTTP request/response smuggling, redirect users to unintended locations, bypass authentication mechanisms relying on client certificates, and gain unauthorized access to sensitive information through various information disclosure flaws. These issues can compromise the confidentiality and integrity of web applications hosted on the affected server. The overall security impact is rated as important by Red Hat.

Red Hat has released version 6.2.3 of JBoss Web Server as a replacement for version 6.2.2, which includes fixes for the listed vulnerabilities. Users should back up their existing installations and apply the 6.2.3 update promptly to mitigate these security issues. The update is available for Red Hat Enterprise Linux 8, 9, 10, and Windows Server platforms. No additional vendor mitigation instructions or temporary workarounds are provided, indicating that applying the update is the recommended remediation.