Red Hat JBoss Web Server 6.1.2 is a security update that addresses two denial of service vulnerabilities in the Apache Tomcat component of the server. CVE-2025-52520 is a general denial of service vulnerability in Apache Tomcat, while CVE-2025-48989 involves a minor HTTP/2-specific denial of service attack exploiting control frames, known as the "MadeYouReset" attack. This release replaces version 6.1.1 and includes additional bug fixes and enhancements. The advisory rates the security impact as Important and recommends updating to version 6.1.2 to mitigate these issues.

Successful exploitation of these vulnerabilities could allow an attacker to cause denial of service conditions in the Apache Tomcat servlet container within Red Hat JBoss Web Server. This could disrupt hosted Java web applications by exhausting resources or resetting connections. The HTTP/2 "MadeYouReset" attack specifically targets HTTP/2 control frames to induce service disruption. No known exploits in the wild have been reported at this time.

Red Hat has released Red Hat JBoss Web Server 6.1.2 as a replacement for 6.1.1, which includes fixes for these denial of service vulnerabilities. Users should back up their existing installations and apply the 6.1.2 update from Red Hat's official channels. No additional mitigations are specified beyond applying this update.