This security advisory for Red Hat JBoss Web Server 6.1.1 addresses four vulnerabilities: CVE-2025-48988 (Apache Tomcat DoS in multipart upload), CVE-2025-49125 (Apache Tomcat security constraint bypass for pre/post-resources), CVE-2025-48976 (Apache Commons FileUpload DoS via part headers), and CVE-2025-53506 (Apache Tomcat denial of service). The update includes bug fixes, enhancements, and component upgrades. The affected product is a fully integrated set of components for hosting Java web applications, including Apache Tomcat and related modules. The advisory rates the security impact as moderate and provides updated packages for Red Hat Enterprise Linux versions 8, 9, and 10. No CVSS base scores are included in the advisory, and no exploits are known to be active in the wild.

The vulnerabilities addressed include denial of service conditions and a security constraint bypass, which could allow an attacker to disrupt service or bypass security restrictions in the affected components of Red Hat JBoss Web Server. The impact is rated as moderate by Red Hat Product Security. There are no reports of active exploitation in the wild at this time.

Red Hat has released Red Hat JBoss Web Server 6.1.1 as a replacement for version 6.1.0, which includes fixes for the identified vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. Since this is an official fix, applying the update is the recommended mitigation.