Red Hat JBoss Web Server 6.1.3 release addresses three security vulnerabilities in Apache Tomcat components: CVE-2025-55752 (directory traversal via rewrite with possible remote code execution), CVE-2025-61795 (denial of service), and CVE-2025-31651 (bypass of rules in Rewrite Valve). These issues affect the tomcat-catalina and tomcat components within the server. The update replaces version 6.1.2 and includes bug fixes, enhancements, and component upgrades. Red Hat rates the security impact as Important. No CVSS scores are provided in the advisory, but detailed information is available on the referenced CVE pages. The vendor advisory confirms the availability of this update for Red Hat Enterprise Linux 8, 9, 10, and Windows Server platforms.

The vulnerabilities fixed in this update could allow attackers to perform directory traversal potentially leading to remote code execution, cause denial of service conditions, or bypass rewrite rules in the Apache Tomcat Rewrite Valve. These issues could compromise the confidentiality, integrity, and availability of applications hosted on Red Hat JBoss Web Server. The exact impact depends on the specific vulnerability but includes possible remote code execution and service disruption.

Red Hat has released Red Hat JBoss Web Server 6.1.3 as a replacement for version 6.1.2, which includes fixes for the described vulnerabilities. Users should back up their existing installations and apply this update promptly. The vendor advisory provides the update download and detailed instructions. No additional mitigations or workarounds are stated in the advisory, indicating that applying the official update is the recommended remediation.