This Red Hat security advisory announces the release of Red Hat JBoss Web Server 5.8.6, which replaces version 5.8.5 and includes fixes for three security vulnerabilities. The first is a minor denial-of-service vulnerability in HTTP/2 via control frames (CVE-2025-48989). The second is a bypass of rules in the Apache Tomcat Rewrite Valve (CVE-2025-31651). The third is a directory traversal vulnerability through rewrite rules that may lead to remote code execution (CVE-2025-55752). These vulnerabilities affect the Apache Tomcat components bundled in Red Hat JBoss Web Server 5.8 for Red Hat Enterprise Linux versions 7, 8, and 9. The advisory references Red Hat's errata RHSA-2025:22925 and provides updated packages to remediate these issues. The vendor classifies the security impact as Important and recommends applying the update after ensuring all previous errata are applied.

The vulnerabilities include a minor denial-of-service attack via HTTP/2 control frames, a bypass of rewrite rules which could allow unintended request handling, and a directory traversal vulnerability that may enable remote code execution. These issues could potentially allow attackers to disrupt service or execute arbitrary code on affected systems running vulnerable versions of Red Hat JBoss Web Server. The vendor rates the overall security impact as Important, indicating significant risk if unpatched.

Red Hat has released Red Hat JBoss Web Server 5.8.6 to address these vulnerabilities. Users should apply this update to their Red Hat JBoss Web Server 5.8 installations on RHEL 7, 8, and 9. Before applying the update, ensure all previously released errata relevant to your system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated beyond applying the official update.