Red Hat JBoss Web Server 5.8.6 is a security update that addresses three vulnerabilities in its Apache Tomcat components. CVE-2025-48989 is a minor incident involving a denial-of-service attack through HTTP/2 control frames. CVE-2025-31651 involves a bypass of rules in the Rewrite Valve, potentially allowing unauthorized request rewriting. CVE-2025-55752 is a directory traversal vulnerability via rewrite rules that could lead to remote code execution. These issues are fixed in the 5.8.6 release, which replaces 5.8.5. The advisory does not provide CVSS scores but classifies the update as important.

The vulnerabilities could allow denial-of-service conditions, bypass of security rules in URL rewriting, and directory traversal potentially leading to remote code execution. These impacts could compromise the confidentiality, integrity, and availability of hosted Java web applications. The severity is rated as important by Red Hat, indicating a high risk but not critical. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released version 5.8.6 of JBoss Web Server containing fixes for these vulnerabilities. Users should back up their existing installations and apply the update promptly. The vendor advisory provides a download link requiring login. No additional mitigations or workarounds are specified. Applying this official update is the recommended remediation.