This advisory covers a security update for Red Hat JBoss Web Server 6.2.4, which includes fixes for several Apache Tomcat vulnerabilities. The fixed issues include improper validation of HTTP/2 request headers (CVE-2026-41293), information disclosure via AJP secret timing discrepancies (CVE-2026-43514), authentication bypass via digest authentication (CVE-2026-43512), improper handling of case sensitivity in LockOutRealm (CVE-2026-43513), improper authorization allowing security bypass (CVE-2026-43515), information disclosure during WebSocket authentication (CVE-2026-42498), denial of service due to uncontrolled resource allocation (CVE-2026-41284), incorrect control flow in rewrite valve (CVE-2026-53404), and security constraint bypass due to improper authorization (CVE-2026-55956). These vulnerabilities affect multiple components of Apache Tomcat integrated in Red Hat JBoss Web Server and could lead to security bypasses, information leaks, or denial of service if unpatched.

The vulnerabilities collectively could allow attackers to bypass authentication mechanisms, disclose sensitive information, cause denial of service through resource exhaustion, and bypass security constraints. This could compromise the confidentiality, integrity, and availability of applications hosted on affected Red Hat JBoss Web Server versions.

A security update to Red Hat JBoss Web Server 6.2.4 is available and should be applied to affected systems. This update replaces version 6.2.3 and includes all relevant security fixes. Users should ensure all previously released errata are applied before updating. Refer to the official Red Hat advisory RHSA-2026:43401 for detailed update instructions. No additional mitigations are specified beyond applying the official patch.