Red Hat JBoss Web Server 6.2.3 addresses seven security vulnerabilities in the Apache Tomcat components it integrates. These include CVE-2026-24880 (HTTP Request/Response Smuggling via invalid chunk extension), CVE-2026-25854 (Open Redirect via LoadBalancerDrainingValve), CVE-2026-29145 and CVE-2026-34500 (Authentication bypass due to client certificate misconfigurations), CVE-2026-29146 (Information disclosure via Padding Oracle vulnerability in EncryptInterceptor), CVE-2026-34483 (Information disclosure due to improper encoding in JsonAccessLogValve), and CVE-2026-34487 (Information disclosure via sensitive data in log files). The update replaces Red Hat JBoss Web Server 6.2.2 and is released for RHEL 8, 9, and 10. The vendor advisory classifies the update as Important and provides detailed fixes and release notes. No CVSS scores are provided in the advisory, but the severity is assessed as high based on the nature of the vulnerabilities.

The vulnerabilities fixed in this update could allow attackers to perform HTTP request/response smuggling, redirect users to malicious sites, bypass authentication mechanisms relying on client certificates, and gain unauthorized access to sensitive information through various information disclosure flaws. These issues affect the Apache Tomcat components within Red Hat JBoss Web Server and could compromise the confidentiality and integrity of hosted Java web applications if exploited.

A security update to Red Hat JBoss Web Server 6.2.3 is available and replaces version 6.2.2. Users should apply this update on Red Hat Enterprise Linux 8, 9, and 10 systems to remediate the listed vulnerabilities. Before applying the update, ensure all previously released errata relevant to your system are applied. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258 for detailed guidance.