Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.2 release and security update
Red Hat JBoss Web Server 6.1.2 includes security updates addressing denial of service vulnerabilities in Apache Tomcat. Two specific issues fixed are CVE-2025-52520, a general Apache Tomcat denial of service, and CVE-2025-48989, a minor incident involving an HTTP/2 "MadeYouReset" DoS attack via HTTP/2 control frames. This release replaces version 6.1.1 and includes bug fixes and component upgrades. The update is rated as having an Important security impact by Red Hat Product Security.
AI Analysis
Technical Summary
Red Hat JBoss Web Server 6.1.2 is a security update that addresses two denial of service vulnerabilities in the Apache Tomcat component. CVE-2025-52520 is a general denial of service vulnerability in Apache Tomcat, while CVE-2025-48989 involves an HTTP/2 "MadeYouReset" denial of service attack through HTTP/2 control frames. These vulnerabilities could allow an attacker to disrupt service availability. The update replaces version 6.1.1 and includes other bug fixes and enhancements. Red Hat has rated the security impact as Important. No CVSS scores are provided in the advisory. The update is available for Red Hat JBoss Web Server 6.1 on Red Hat Enterprise Linux 8, 9, and 10.
Potential Impact
The vulnerabilities addressed are denial of service issues that could allow an attacker to disrupt the availability of the Apache Tomcat servlet container within Red Hat JBoss Web Server. This could impact hosted Java web applications by causing service interruptions. The advisory rates the impact as Important but does not provide CVSS scores. There are no known exploits in the wild reported at this time.
Mitigation Recommendations
Red Hat has released Red Hat JBoss Web Server 6.1.2 as a replacement for 6.1.1, which includes fixes for these denial of service vulnerabilities. Users should apply this update to remediate the issues. Before applying this update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258 for detailed guidance. No additional mitigation steps are indicated by the vendor.
Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.2 release and security update
Description
Red Hat JBoss Web Server 6.1.2 includes security updates addressing denial of service vulnerabilities in Apache Tomcat. Two specific issues fixed are CVE-2025-52520, a general Apache Tomcat denial of service, and CVE-2025-48989, a minor incident involving an HTTP/2 "MadeYouReset" DoS attack via HTTP/2 control frames. This release replaces version 6.1.1 and includes bug fixes and component upgrades. The update is rated as having an Important security impact by Red Hat Product Security.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat JBoss Web Server 6.1.2 is a security update that addresses two denial of service vulnerabilities in the Apache Tomcat component. CVE-2025-52520 is a general denial of service vulnerability in Apache Tomcat, while CVE-2025-48989 involves an HTTP/2 "MadeYouReset" denial of service attack through HTTP/2 control frames. These vulnerabilities could allow an attacker to disrupt service availability. The update replaces version 6.1.1 and includes other bug fixes and enhancements. Red Hat has rated the security impact as Important. No CVSS scores are provided in the advisory. The update is available for Red Hat JBoss Web Server 6.1 on Red Hat Enterprise Linux 8, 9, and 10.
Potential Impact
The vulnerabilities addressed are denial of service issues that could allow an attacker to disrupt the availability of the Apache Tomcat servlet container within Red Hat JBoss Web Server. This could impact hosted Java web applications by causing service interruptions. The advisory rates the impact as Important but does not provide CVSS scores. There are no known exploits in the wild reported at this time.
Mitigation Recommendations
Red Hat has released Red Hat JBoss Web Server 6.1.2 as a replacement for 6.1.1, which includes fixes for these denial of service vulnerabilities. Users should apply this update to remediate the issues. Before applying this update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258 for detailed guidance. No additional mitigation steps are indicated by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:13685
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-52520"]
Threat ID: 6a419cb727e9c79719abd8b9
Added to database: 06/28/2026, 22:14:15 UTC
Last enriched: 08/04/2026, 15:50:51 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 36
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.