This security advisory covers Red Hat JBoss Web Server 6.2.4, which addresses multiple vulnerabilities in Apache Tomcat components integrated within the server. The fixed issues include CVE-2026-41293 (HTTP/2 request headers not validated), CVE-2026-43514 (information disclosure via AJP secret timing discrepancy), CVE-2026-43512 (authentication bypass via digest authentication), CVE-2026-43513 (improper handling of case sensitivity in LockOutRealm), CVE-2026-43515 (improper authorization allowing security bypass), CVE-2026-42498 (information disclosure during WebSocket authentication), CVE-2026-41284 (denial of service due to uncontrolled resource allocation), CVE-2026-53404 (incorrect control flow in rewrite valve), and CVE-2026-55956 (improper authorization allowing security constraint bypass). These vulnerabilities affect the Apache Tomcat servlet container and related components bundled in Red Hat JBoss Web Server 6.2 on RHEL 8, 9, and 10. The update to version 6.2.4 includes bug fixes, enhancements, and component upgrades documented in the release notes. No known exploits in the wild have been reported at this time.

The vulnerabilities fixed in this update could allow attackers to bypass authentication mechanisms, disclose sensitive information, cause denial of service conditions, and bypass security constraints in the affected Apache Tomcat components. These issues could impact the confidentiality, integrity, and availability of Java web applications hosted on Red Hat JBoss Web Server 6.2 prior to version 6.2.4.

Red Hat has released Red Hat JBoss Web Server 6.2.4 as a replacement for version 6.2.3, which includes fixes for all listed vulnerabilities. Users should apply this update to remediate the security issues. Before applying the update, ensure all previously released errata relevant to the system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated beyond applying the official update.