Red Hat Product Errata RHSA-2026:39188 - Security Advisory
Issued:
2026-07-14
Updated:
2026-07-14

RHSA-2026:39188 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 7.0.0 security release

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Red Hat JBoss Web Server 7.0 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 7.0.0 serves as a replacement for Red Hat JBoss Web Server 6.2.3. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.

Security fix(es):

  • tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)
  • tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)
  • tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
  • tomcat-catalina: Apache Tomcat: Denial of Service due to uncontrolled resource allocation (CVE-2026-41284)
  • tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
  • tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498)
  • tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
  • tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
  • tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy (CVE-2026-43514)
  • tomcat-catalina: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass (CVE-2026-55956)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 7 for RHEL 10 x86_64
  • JBoss Enterprise Web Server 7 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 7 for RHEL 8 x86_64

Fixes

  • BZ - 2457020 - CVE-2026-29146 Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor
  • BZ - 2457027 - CVE-2026-34486 Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass
  • BZ - 2476511 - CVE-2026-43512 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
  • BZ - 2476512 - CVE-2026-43514 tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy
  • BZ - 2476513 - CVE-2026-41293 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
  • BZ - 2476516 - CVE-2026-42498 tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.
  • BZ - 2476519 - CVE-2026-43515 tomcat-coyote: tomcat: Improper Authorization allows security bypass
  • BZ - 2476520 - CVE-2026-43513 tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm
  • BZ - 2494676 - CVE-2026-55956 tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

JBoss Enterprise Web Server 7 for RHEL 10

SRPM
jws7-ecj-4.38.0-1.redhat_00001.1.el10jws.src.rpm SHA-256: 3c065768fbce99b758fa714613134677978e1571eecc9d0f638f29bdc2417047
jws7-javapackages-tools-6.0.0-1.el10jws.src.rpm SHA-256: 20890b2e04a41f33cde9564ff5d03e797d9be700b90018ff9ae2d44361daeda8
jws7-jboss-logging-3.6.2-1.Final_redhat_00001.1.el10jws.src.rpm SHA-256: 178c44eb52941ff7f56bc1e3911cddaf92f2a5b8dbca1728462b1759eb8ad160
jws7-mod_cluster-2.1.0-1.Final_redhat_00001.1.el10jws.src.rpm SHA-256: 8b7729494a8ebca8efc6353c769245036299bb23d5941617bf1c4b9390157d35
jws7-tomcat-11.0.21-5.redhat_00004.1.el10jws.src.rpm SHA-256: 569b1b33a3c2a9efbe0b21a9fd83b8591c0b2e35ce88b34d96bc8642c46568cc
jws7-tomcat-native-1.3.7-2.redhat_2.el10jws.src.rpm SHA-256: 9392a0687046d1a4012c6b740070885c49418fe53646586abc535cdfa0588110
jws7-tomcat-vault-1.1.11-4.Final_redhat_00003.1.el10jws.src.rpm SHA-256: 37dd5e831e978e4df158c055797ded3dd4e051aa90a0a7a2dfc4f33939056a21
x86_64
jws7-build-1-1.el10jws.x86_64.rpm SHA-256: 3ad1936944b81b64a6cdf2e31043162dc7a69b51f5a48c1da73d87d9761e4b63
jws7-ecj-4.38.0-1.redhat_00001.1.el10jws.noarch.rpm SHA-256: 7cb2fd886f46ee6e9b9e51461b7d223aff01a263177755d7b3e7f21e99c999ed
jws7-javapackages-filesystem-6.0.0-1.el10jws.noarch.rpm SHA-256: c75bcbec184b68f50bf05ab5299cdc1f3dfc3278cdb32ff5538393fb966cc260
jws7-javapackages-tools-6.0.0-1.el10jws.noarch.rpm SHA-256: 6078885ae7dd3378d0b4ef6e9a3da93fc805bf15bcc9a785512405d7e7e81f67
jws7-jboss-logging-3.6.2-1.Final_redhat_00001.1.el10jws.noarch.rpm SHA-256: ad642b9a0de0b1a69dab6231b90a498e450eee4ad8afcf2dc69af27611990ac3
jws7-mod_cluster-2.1.0-1.Final_redhat_00001.1.el10jws.noarch.rpm SHA-256: 99e181afc0e32ddc3403c1c0d2cb267412a85f409b29b3f05b6356669e7a1945
jws7-mod_cluster-tomcat-2.1.0-1.Final_redhat_00001.1.el10jws.noarch.rpm SHA-256: 3f608904fcbddc4c63f50a542e260edab3c7f370c25d976c05488c6eccf2c996
jws7-python3-javapackages-6.0.0-1.el10jws.noarch.rpm SHA-256: 78d37bc517fb310901d7499f479cf8670995ba6e61e70a49f3446b1017b7ec96
jws7-runtime-1-1.el10jws.x86_64.rpm SHA-256: 157ff1103a249a1e80402a79602c737116546935e82343a7a681352f8407f26c
jws7-tomcat-11.0.21-5.redhat_00004.1.el10jws.noarch.rpm SHA-256: 5dfaaf33db2408b310cb2414ddad1fd055582bb195adaa2852ed50210b52d1ee
jws7-tomcat-admin-webapps-11.0.21-5.redhat_00004.1.el10jws.noarch.rpm SHA-256: a2ce567e2b134d31f15bdfdac4a09b6ee1d4a6efb0656f35d7f955e2aad78df6
jws7-tomcat-docs-webapp-11.0.21-5.redhat_00004.1.el10jws.noarch.rpm SHA-256: b98672f71a6b3ec201578147a327d468fe3b0b62c7fa257bd24a3da49df9997d
jws7-tomcat-el-5.0-api-11.0.21-5.redhat_00004.1.el10jws.noarch.rpm SHA-256: 6b673f902e15171c6b24311c63669ef171843b9ea35083b544bd21010d4bcc6b
jws7-tomcat-javadoc-11.0.21-5.redhat_00004.1.el10jws.noarch.rpm SHA-256: c7de0a03081eaec84117301f9b3ede7e7144d745fdfd0082919e89e46486f19f
jws7-tomcat-jsp-3.1-api-11.0.21-5.redhat_00004.1.el10jws.noarch.rpm SHA-256: bd2d7b60c0954c7edbda98cfcddb7451a806a49d8cf8d22e4fd3b19a1ce5a2d0
jws7-tomcat-lib-11.0.21-5.redhat_00004.1.el10jws.noarch.rpm SHA-256: 27db39b3efd64d8bfe63a3a1d4c3d67b4f116954e490e03c6b9f7efcbffe422f
jws7-tomcat-native-1.3.7-2.redhat_2.el10jws.x86_64.rpm SHA-256: 27b2a27bc0e5e87662c1c476113ad0c046d44346e4b4c1321bc2c18c6312fae8
jws7-tomcat-native-debuginfo-1.3.7-2.redhat_2.el10jws.x86_64.rpm SHA-256: 2ff1d62f4e2fc394123bb9fad83e7225438da37e5162c1a8e571a1b9ece903ee
jws7-tomcat-selinux-11.0.21-5.redhat_00004.1.el10jws.noarch.rpm SHA-256: 003a1698e43b591599d23fbd611fda8ebaa5a7fd92cf08c3548c9b8110617512
jws7-tomcat-servlet-6.0-api-11.0.21-5.redhat_00004.1.el10jws.noarch.rpm SHA-256: f9ab21cb23a910f8fc212dc36946bd87637d0106cd93e6838c9c68b43325a93d
jws7-tomcat-vault-1.1.11-4.Final_redhat_00003.1.el10jws.noarch.rpm SHA-256: 3c5adfb85397942620172e14d2691bcfb1dcbef5b6ec1939c7f620e6d4fdd530
jws7-tomcat-vault-javadoc-1.1.11-4.Final_redhat_00003.1.el10jws.noarch.rpm SHA-256: 55743b7c97207d485bcdd0564022e710a3b771a743849a5ccdc2ebc2705e8bfb
jws7-tomcat-webapps-11.0.21-5.redhat_00004.1.el10jws.noarch.rpm SHA-256: 91dd9ccbf3c5b2272f9635955b2aef72ced850dbcc0b4f605007a47bd7d17bfa

JBoss Enterprise Web Server 7 for RHEL 9

SRPM
jws7-ecj-4.38.0-1.redhat_00001.1.el9jws.src.rpm SHA-256: 163eccdf9f3eae2146cf109160044893f6e33d048461050697d13b9201334249
jws7-javapackages-tools-6.0.0-1.el9jws.src.rpm SHA-256: 95a07e8dc275a2a2f0ee44725e2a97fab87767793b2b400ed2820331117f6180
jws7-jboss-logging-3.6.2-1.Final_redhat_00001.1.el9jws.src.rpm SHA-256: 7c2519f54114f7e86d7248ea9bcd46c6dc79f562575c2d0162b6a3867cf466f1
jws7-mod_cluster-2.1.0-1.Final_redhat_00001.1.el9jws.src.rpm SHA-256: 4f92865811cf6242d5cb2a7d585570ef37868e476a4149d50404f8624b9415d1
jws7-tomcat-11.0.21-5.redhat_00004.1.el9jws.src.rpm SHA-256: 5f4cb9105259fbb9f55c4a4065b21aa9188cf0e18203fc3156a0860ec28e3a39
jws7-tomcat-native-1.3.7-2.redhat_2.el9jws.src.rpm SHA-256: 4dea9410c44d233201bdfd41f8cee6ba40c3c9976b9f82212cde39f692bf0b16
jws7-tomcat-vault-1.1.11-4.Final_redhat_00003.1.el9jws.src.rpm SHA-256: 6b8d8b069af91478993f6744c338e24f2e4cb368f3a7f865f423af2a7089d158
x86_64
jws7-build-1-1.el9jws.x86_64.rpm SHA-256: 7919975d1ca4b22f580bd4d337600f240f9ea60c3931a179afa51b86270b15e1
jws7-ecj-4.38.0-1.redhat_00001.1.el9jws.noarch.rpm SHA-256: 171c4e12ba50a1d82c7bf365546ec027f5a710e3c336a149fec6c7deced70660
jws7-javapackages-filesystem-6.0.0-1.el9jws.noarch.rpm SHA-256: 20551c8a945386af8d2fb73ac9d80f189af2ab32915f5f171508f3bee5352ef4
jws7-javapackages-tools-6.0.0-1.el9jws.noarch.rpm SHA-256: 73d577f6a5c3a47641ff1994c23aa7cde90f57265e1f37d395016d5f1871d8f7
jws7-jboss-logging-3.6.2-1.Final_redhat_00001.1.el9jws.noarch.rpm SHA-256: fa85d5ec28f2cb4905d56016ce193475fffcbd34b423598ea9ed116391c4eca5
jws7-mod_cluster-2.1.0-1.Final_redhat_00001.1.el9jws.noarch.rpm SHA-256: 8bea4d534c1049e1c97218ee6a54a8f46abcbca1e1f9f597d51db233e05de8be
jws7-mod_cluster-tomcat-2.1.0-1.Final_redhat_00001.1.el9jws.noarch.rpm SHA-256: 1be4367c376ee3d819ea95a4bcbdd7ef03c59ee0219a7c5732273043a74c899e
jws7-python3-javapackages-6.0.0-1.el9jws.noarch.rpm SHA-256: c84870715d1a1540c88922a74efb8ae480e2276a112808c7613edc44687d58d6
jws7-runtime-1-1.el9jws.x86_64.rpm SHA-256: e567ce55e50c97ffd17321762a68f67ea9d498c04b1ec881a2bc2addf186d59b
jws7-tomcat-11.0.21-5.redhat_00004.1.el9jws.noarch.rpm SHA-256: bbcde50e42c07409313424eb09bda914b1c86d7a47585ecdc29b228488475822
jws7-tomcat-admin-webapps-11.0.21-5.redhat_00004.1.el9jws.noarch.rpm SHA-256: 7e9de78e254e5d8faeb38409898bc1e0dd5c94aa1e820bf1c7d021639587e675
jws7-tomcat-docs-webapp-11.0.21-5.redhat_00004.1.el9jws.noarch.rpm SHA-256: a451c9d7b17eb135cd99e039dd7eafa077709528494df302a5f0b1b0411dba67
jws7-tomcat-el-5.0-api-11.0.21-5.redhat_00004.1.el9jws.noarch.rpm SHA-256: 07d0192ae742d6116194ee0735c62b1fae90fbfd04baf51543ac5cf0ef94f57e
jws7-tomcat-javadoc-11.0.21-5.redhat_00004.1.el9jws.noarch.rpm SHA-256: 86c66b79c1d95bd418879b94acff6fa0695b9e055cfba7436969b0500a90af78
jws7-tomcat-jsp-3.1-api-11.0.21-5.redhat_00004.1.el9jws.noarch.rpm SHA-256: f001640eab9f59c9362e2e0bf8140f7d0fbafd67c7a9ad4e195ba140ea41ebc0
jws7-tomcat-lib-11.0.21-5.redhat_00004.1.el9jws.noarch.rpm SHA-256: 88cda9f671db9ae2ca52842e3d707a7bc79ae482d827937f0649bd5375c611d3
jws7-tomcat-native-1.3.7-2.redhat_2.el9jws.x86_64.rpm SHA-256: ce0e5e104cd1497de4574c033b556225305eebe52d058af12bce3ffad23dc197
jws7-tomcat-native-debuginfo-1.3.7-2.redhat_2.el9jws.x86_64.rpm SHA-256: fba0e599b6608a5f1fa9fe83787ca026f1a499ca5cbaed17e8237ff54d43fd9e
jws7-tomcat-selinux-11.0.21-5.redhat_00004.1.el9jws.noarch.rpm SHA-256: e5dc71f306f4861fdb69d3c5f93e0012881dc9d70cc953461a8e5c7e4634ddbb
jws7-tomcat-servlet-6.0-api-11.0.21-5.redhat_00004.1.el9jws.noarch.rpm SHA-256: e1c232d17be71026e781e7959bf40ce3f1ba64b199bc09bcad078a6827930ba1
jws7-tomcat-vault-1.1.11-4.Final_redhat_00003.1.el9jws.noarch.rpm SHA-256: 2ffe1a815377fe1d0aa9c3a08e11402ed8ddbbfc95df69ef15e8f0e45eb4c57f
jws7-tomcat-vault-javadoc-1.1.11-4.Final_redhat_00003.1.el9jws.noarch.rpm SHA-256: 15080abcbf6eb95537d4b75d27552748789f1ac4483d9606aac95a7d2eff0bf0
jws7-tomcat-webapps-11.0.21-5.redhat_00004.1.el9jws.noarch.rpm SHA-256: 9887e39f334a254c9631dd5c96e886faf6aee61942e8848c0ce3d302b89892f6

JBoss Enterprise Web Server 7 for RHEL 8

SRPM
jws7-ecj-4.38.0-1.redhat_00001.1.el8jws.src.rpm SHA-256: 6c5f9e6bb20bec1828c05121c0e3327f972c504bbd29c314abcb6b9f1480f8ae
jws7-javapackages-tools-6.0.0-1.el8jws.src.rpm SHA-256: 3f7cd4c99e0ed8ca70bb2bdf820176f419d4e16271856071e31c94560480479d
jws7-jboss-logging-3.6.2-1.Final_redhat_00001.1.el8jws.src.rpm SHA-256: b9eb06058f5d720939fd5dffed1d8dac2c5654773fb7b991430bad9463fe49d3
jws7-mod_cluster-2.1.0-1.Final_redhat_00001.1.el8jws.src.rpm SHA-256: c0a9a5d5697a3b7d5e595e5d9d18138d1a740c789c78fc0206af81bb6d3eed17
jws7-tomcat-11.0.21-5.redhat_00004.1.el8jws.src.rpm SHA-256: 0dd554ee7ae4270647703bbbca7f419e5071e7a488fae1a1e8fa9c1f545bee74
jws7-tomcat-native-1.3.7-2.redhat_2.el8jws.src.rpm SHA-256: 06216cb61f9e546365949db366d5580a6e63d80be98dc71242ec340638703956
jws7-tomcat-vault-1.1.11-4.Final_redhat_00003.1.el8jws.src.rpm SHA-256: 72d55aea1a88f56b07ca59f2ff188eeaad8cbcb9904d39790f0b4a7fdb7f9f5f
x86_64
jws7-build-1-1.el8jws.x86_64.rpm SHA-256: 91d1e1cd92d0f5ed73c14a6ee3898c719b5097705c0e1a27667f0906e5ffc48d
jws7-ecj-4.38.0-1.redhat_00001.1.el8jws.noarch.rpm SHA-256: 47d37fa667ef5fd13255f5ec01784e0795243669004d70d18d4567548660d8cc
jws7-javapackages-filesystem-6.0.0-1.el8jws.noarch.rpm SHA-256: 4a05732e9a324777ffc65f2b636a03f1a758c5f80b5936d212d110a2978b0751
jws7-javapackages-tools-6.0.0-1.el8jws.noarch.rpm SHA-256: 9b53f7f5d313847a2b360876ceb675c6074aa7f7cb8e6c31716b8670654a651e
jws7-jboss-logging-3.6.2-1.Final_redhat_00001.1.el8jws.noarch.rpm SHA-256: dcaf0a64360ffc5724fe45e46f14d1da50750252091e893d5bd98b61c9af2d52
jws7-mod_cluster-2.1.0-1.Final_redhat_00001.1.el8jws.noarch.rpm SHA-256: 8b096af2588b870319e73fd5c6d9b1e7c2fd37f2c035432b3a1fd58d054ba5dd
jws7-mod_cluster-tomcat-2.1.0-1.Final_redhat_00001.1.el8jws.noarch.rpm SHA-256: 2585943e620d0047ad3c6bed2cfe3d3858add345409f6c6a5cbfddae904789e2
jws7-python3-javapackages-6.0.0-1.el8jws.noarch.rpm SHA-256: 42b0d98e104e6cd5ef54fccb4427e50ccd59e4eaaba88fd92f537e1574b1f1f3
jws7-runtime-1-1.el8jws.x86_64.rpm SHA-256: 9ad67380f9836054e58ae7ee5c21264af55cc212afb9af10ab7c73d6fee7a0f6
jws7-tomcat-11.0.21-5.redhat_00004.1.el8jws.noarch.rpm SHA-256: fa5a484dd72d225706f3423ae4992a5d64cb1a11dd16cd27be4e8cd6e4888fe9
jws7-tomcat-admin-webapps-11.0.21-5.redhat_00004.1.el8jws.noarch.rpm SHA-256: 072eddc4cde614c17e6cb2d64a6c96f986138bb9153d9419d7d27ef7ddc386e2
jws7-tomcat-docs-webapp-11.0.21-5.redhat_00004.1.el8jws.noarch.rpm SHA-256: 0e7574b0bfc415f5b7b40eba67e17ab0500b4abcb6c2f3eab817f249e5f34e82
jws7-tomcat-el-5.0-api-11.0.21-5.redhat_00004.1.el8jws.noarch.rpm SHA-256: 167632e0c83825b65f817780d5c48e64b96633782e0132b9b2fce6190873535d
jws7-tomcat-javadoc-11.0.21-5.redhat_00004.1.el8jws.noarch.rpm SHA-256: 80823859a24391a73419c3c83fc59743fc81cec66da7b2ec029a205e18fb5f22
jws7-tomcat-jsp-3.1-api-11.0.21-5.redhat_00004.1.el8jws.noarch.rpm SHA-256: 69e427291f26ba88cc8ace2e239af3cca5c629b40681e5565e5a5cb93a556e2f
jws7-tomcat-lib-11.0.21-5.redhat_00004.1.el8jws.noarch.rpm SHA-256: 4c8911ff7470212d0f02bf98f42ba71bcf805c85c3da28d80029867081e817cb
jws7-tomcat-native-1.3.7-2.redhat_2.el8jws.x86_64.rpm SHA-256: c9ec819c0521ea413e489c7f84ca0a6175b194fead0eae746aefd6d8ad4cd251
jws7-tomcat-native-debuginfo-1.3.7-2.redhat_2.el8jws.x86_64.rpm SHA-256: 03bcaa3a5799814f22a909038b9a1bc295a587a92aa0b2af32e6a1e841097a67
jws7-tomcat-selinux-11.0.21-5.redhat_00004.1.el8jws.noarch.rpm SHA-256: ab601e36c1245631d93d1044c10a9cbc45d584bfececf1949c29aa4fbf6dd549
jws7-tomcat-servlet-6.0-api-11.0.21-5.redhat_00004.1.el8jws.noarch.rpm SHA-256: 9c8968cc2268ba1252277d4a8c9a1f21c8713dbf30d25c92bb37c0e7398ee51e
jws7-tomcat-vault-1.1.11-4.Final_redhat_00003.1.el8jws.noarch.rpm SHA-256: 6848fe574812ddc0af5f6cdb5b33e1352c6d4badda3ff45733f3135da9371f0a
jws7-tomcat-vault-javadoc-1.1.11-4.Final_redhat_00003.1.el8jws.noarch.rpm SHA-256: b622b220433d0832e541ed84adc697e00d41f0861bbbc3231d720386f5e24858
jws7-tomcat-webapps-11.0.21-5.redhat_00004.1.el8jws.noarch.rpm SHA-256: 6ab9492d966dec4911cebe70cfe21bb9e70c5137b341b64ff256e3d4238dad30

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.