This Red Hat security advisory announces the release of Red Hat JBoss Web Server 6.2.2, which replaces version 6.2.1 and addresses four security vulnerabilities. The vulnerabilities include: CVE-2025-66614, a client certificate verification bypass due to virtual host mapping in Tomcat; CVE-2026-24733, a security constraint bypass with HTTP/0.9 in Tomcat; CVE-2026-31790, an information disclosure from uninitialized memory via an invalid RSA public key in OpenSSL; and CVE-2026-32990, an improper input validation vulnerability in Apache Tomcat due to an incomplete fix. The advisory confirms that a patch is available and recommends updating to version 6.2.2. The update also includes other bug fixes and component upgrades. The vulnerabilities are rated as moderate in severity by Red Hat Product Security. No CVSS scores are provided in the advisory, but detailed CVSS scores can be found on the respective CVE pages. The affected versions explicitly include 6.2.1 and versions earlier than 11.0.15.

The vulnerabilities addressed in this update could allow bypass of client certificate verification, security constraint bypass, information disclosure from uninitialized memory, and improper input validation within Red Hat JBoss Web Server components. These issues may impact the security of hosted Java web applications by potentially allowing unauthorized access or leakage of sensitive information. The overall security impact is rated as moderate by Red Hat Product Security. There are no known exploits in the wild at the time of this advisory.

A security update is available in Red Hat JBoss Web Server version 6.2.2, which replaces version 6.2.1 and addresses the listed vulnerabilities. Users should back up their existing installations, including applications and configuration files, before applying the update. Applying this update is the recommended remediation to mitigate these vulnerabilities. No additional vendor advisories indicate that no action is required or that the issues are already mitigated.