This advisory covers a set of security vulnerabilities fixed in Red Hat JBoss Web Server 5.8.5, which is a certified set of components for hosting Java web applications including Apache Tomcat and related modules. The fixed vulnerabilities include multiple denial of service issues in Apache Tomcat and Apache Commons FileUpload (CVE-2025-48976, CVE-2025-48988, CVE-2025-52520, CVE-2025-52434, CVE-2025-53506) and a security constraint bypass in Tomcat's pre/post-resources handling (CVE-2025-49125). These flaws could allow attackers to cause service disruption or bypass security constraints. The update is a replacement for version 5.8.4 and includes other bug fixes and enhancements documented in the release notes. Red Hat rates the security impact as moderate.

The vulnerabilities addressed primarily allow denial of service attacks against the Apache Tomcat servlet container and related components, potentially disrupting hosted Java web applications. One vulnerability allows bypassing security constraints, which could lead to unauthorized access to protected resources. The overall impact is service disruption and potential unauthorized resource access. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released Red Hat JBoss Web Server 5.8.5 as a replacement for version 5.8.4, which includes fixes for these vulnerabilities. Users should apply this update to affected systems running Red Hat JBoss Web Server 5.8 on RHEL 7, 8, or 9. Before applying the update, ensure all previously released errata relevant to the system have been applied. Refer to Red Hat's official update documentation for detailed instructions. No additional mitigations are specified by the vendor.