This advisory covers several security fixes in Red Hat JBoss Web Server 6.2.3, which includes Apache Tomcat components. Notably, CVE-2026-29146 addresses an information disclosure vulnerability via a Padding Oracle attack in the EncryptInterceptor. Other fixed vulnerabilities include authentication bypasses due to client certificate misconfigurations, HTTP request/response smuggling, open redirect, and information disclosure through improper encoding and sensitive data in logs. The advisory provides updated packages for affected Red Hat Enterprise Linux versions and JBoss Web Server versions, replacing prior releases to mitigate these issues.

The vulnerabilities could allow attackers to disclose sensitive information, bypass authentication mechanisms, perform HTTP request/response smuggling, and exploit open redirect flaws. These impacts can lead to unauthorized access or information leakage in affected Red Hat JBoss Web Server deployments using Apache Tomcat. The severity is rated as high by Red Hat Product Security.

Red Hat has released updated packages for Red Hat JBoss Web Server 6.2.3 that address these vulnerabilities. Users should apply these official security updates as soon as possible. Before applying the update, it is recommended to back up existing installations and configurations. All previously released errata relevant to the system should be applied prior to this update. No additional mitigation steps are indicated beyond applying the official patches.