Red Hat JBoss Web Server 6.1.2 is a security update that addresses two denial of service vulnerabilities in its Apache Tomcat servlet container component. The first vulnerability, CVE-2025-52520, is a general Apache Tomcat denial of service issue. The second, CVE-2025-48989, is a minor incident involving a denial of service attack through HTTP/2 control frames, known as the "MadeYouReset" attack. These vulnerabilities could allow an attacker to disrupt service availability. The update replaces version 6.1.1 and includes bug fixes and component upgrades. Red Hat rates the security impact as important. No CVSS scores are provided in the advisory.

The vulnerabilities addressed are denial of service issues that could cause disruption of service in Red Hat JBoss Web Server via its Apache Tomcat component. The HTTP/2 "MadeYouReset" attack (CVE-2025-48989) is classified as a minor incident, indicating a lower severity denial of service vector. The overall security impact is rated important by Red Hat, indicating a significant but not critical threat to service availability.

Red Hat has released Red Hat JBoss Web Server 6.1.2 as a replacement for version 6.1.1, which includes fixes for these denial of service vulnerabilities. Users should apply this update to remediate the issues. Before applying the update, ensure all previously released errata relevant to your system have been applied. For detailed update instructions, refer to Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.