Red Hat Product Errata RHSA-2026:93618 - Security Advisory
Issued:
2026-11-03
Updated:
2026-11-03

RHSA-2026:93618 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 7.0.3 release and security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Red Hat JBoss Web Server 7.0.3 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 7.0.3 serves as a replacement for Red Hat JBoss Web Server 7.0.2. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.

Security Fix(es):

  • mod_cluster-core: mod_cluster Advertise Listener: unauthenticated DoS via crafted multicast datagram (CVE-2026-76166)
  • jws7-tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition (CVE-2026-86247)
  • jws7-tomcat: Apache Tomcat: Denial of Service via AJP request (CVE-2026-78383)
  • jws7-tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close (CVE-2026-77791)
  • jws7-tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up (CVE-2026-86350)
  • jws7-tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints (CVE-2026-76183)
  • jws7-tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts (CVE-2026-79677)
  • jws7-tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists (CVE-2026-73581)
  • jws7-tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVE-2026-86248)
  • jws7-tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake (CVE-2026-86243)
  • jws7-tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration (CVE-2026-86246)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 7 for RHEL 10 x86_64
  • JBoss Enterprise Web Server 7 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 7 for RHEL 8 x86_64

Fixes

  • BZ - 2510883 - CVE-2026-76166 modcluster-core: mod_cluster Advertise Listener: unauthenticated DoS via crafted multicast datagram
  • BZ - 2539355 - CVE-2026-76183 tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints
  • BZ - 2539356 - CVE-2026-73581 tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists
  • BZ - 2539370 - CVE-2026-86350 tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up
  • BZ - 2539393 - CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition
  • BZ - 2539394 - CVE-2026-86246 tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration
  • BZ - 2539395 - CVE-2026-86243 tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake
  • BZ - 2539396 - CVE-2026-77791 tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close
  • BZ - 2539486 - CVE-2026-78383 tomcat: Apache Tomcat: Denial of Service via AJP request
  • BZ - 2539616 - CVE-2026-79677 tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts
  • BZ - 2542847 - CVE-2026-86248 tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

JBoss Enterprise Web Server 7 for RHEL 10

SRPM
jws7-mod_cluster-2.1.1-1.Final_redhat_00001.1.el10jws.src.rpm SHA-256: 5fe4ebc1e65393f6612763f9c3939713c2f130416091a804a21057089569d57b
jws7-tomcat-11.0.21-10.redhat_00010.1.el10jws.src.rpm SHA-256: 1ea44cd29c955106fd613bd1008dba03d1c636cc1c9c1caa39f4ac00790908cb
jws7-tomcat-native-1.3.7-4.redhat_4.el10jws.src.rpm SHA-256: 99e060cf1873cc0eae25f8f542a5c30e94bab12210c211c297418752b1615c70
x86_64
jws7-mod_cluster-2.1.1-1.Final_redhat_00001.1.el10jws.noarch.rpm SHA-256: 1ef11bceade852aba048b31308c1cfea1f67fd66379893d6a57585e3e3bd15a0
jws7-mod_cluster-tomcat-2.1.1-1.Final_redhat_00001.1.el10jws.noarch.rpm SHA-256: 2e77f7624d8828b154a3c6c4fd4e3d62b4a69cc0770eb56ecd2415ae38a73ed5
jws7-tomcat-11.0.21-10.redhat_00010.1.el10jws.noarch.rpm SHA-256: 6cafd432e71e227bb17173eed05c374a33e0ff130502be077e55e8faddc39995
jws7-tomcat-admin-webapps-11.0.21-10.redhat_00010.1.el10jws.noarch.rpm SHA-256: 78d10ce85c201cb540b9d15208803276fc6cc0ab4e29a9bb6a9cf3462404bab9
jws7-tomcat-docs-webapp-11.0.21-10.redhat_00010.1.el10jws.noarch.rpm SHA-256: 341676f95c9162ac839680cf81369ac70aa9ea40fd6ee866de02befd8191838d
jws7-tomcat-el-5.0-api-11.0.21-10.redhat_00010.1.el10jws.noarch.rpm SHA-256: fedc7840aa0e0211520f84e317a7b6181ee25b70efdfa6f9a896a5092e57e5bb
jws7-tomcat-javadoc-11.0.21-10.redhat_00010.1.el10jws.noarch.rpm SHA-256: 02efefa7848086b2169cb9063032ad493d491cc699c1aea4221225bb34cb9943
jws7-tomcat-jsp-3.1-api-11.0.21-10.redhat_00010.1.el10jws.noarch.rpm SHA-256: d3da307408366ef1883ec3f53329eca600791769b72d88a23a97a7e4862ad705
jws7-tomcat-lib-11.0.21-10.redhat_00010.1.el10jws.noarch.rpm SHA-256: fadf497c69dd1cabc7d8b00445d8a66fb5438c700adf9b098792d44089368421
jws7-tomcat-native-1.3.7-4.redhat_4.el10jws.x86_64.rpm SHA-256: fc52e0ce19022ab36f7922efb13b30b5e6724a95a65064378245bd86f17e2d29
jws7-tomcat-native-debuginfo-1.3.7-4.redhat_4.el10jws.x86_64.rpm SHA-256: 627a3a9df182a795e03bb665e2d44b894daabd594cd537319fda7b28922ef3a1
jws7-tomcat-selinux-11.0.21-10.redhat_00010.1.el10jws.noarch.rpm SHA-256: 844629e976e07274f761e84bf89145fa072c925002c772c8191ba8c9fbf6b104
jws7-tomcat-servlet-6.0-api-11.0.21-10.redhat_00010.1.el10jws.noarch.rpm SHA-256: 9aeb1e50a9349c388e9f8766e52405c2e5aa3576bf8f623633590de5f8576b79
jws7-tomcat-webapps-11.0.21-10.redhat_00010.1.el10jws.noarch.rpm SHA-256: 491d94fff8adf6cdefe3b8e3356b39bc2aa703a61688e2e7b01cb8a8044f0f85

JBoss Enterprise Web Server 7 for RHEL 9

SRPM
jws7-mod_cluster-2.1.1-1.Final_redhat_00001.1.el9jws.src.rpm SHA-256: 07f614e8f4366377cad13e609a7373e280e2c1b1153f0bfe8306d36affe11cc6
jws7-tomcat-11.0.21-10.redhat_00010.1.el9jws.src.rpm SHA-256: d406fa9dbea1d6a7b477e0e9d80293b0b9a63229162b838930e43bb3ab89e838
jws7-tomcat-native-1.3.7-4.redhat_4.el9jws.src.rpm SHA-256: e3b9ca392457eda5b229544c5a90bc11c9bcb7f25cc110e68b65003d93df7591
x86_64
jws7-mod_cluster-2.1.1-1.Final_redhat_00001.1.el9jws.noarch.rpm SHA-256: 778b0de40fe8267adc00fd839fccc5c6eefc7a75479d563a285c5c775bc024fb
jws7-mod_cluster-tomcat-2.1.1-1.Final_redhat_00001.1.el9jws.noarch.rpm SHA-256: 506f10ed315730af275efba4472b814bdf6fdb2c2552e74b671465dae3f5bf02
jws7-tomcat-11.0.21-10.redhat_00010.1.el9jws.noarch.rpm SHA-256: ab746337e5e32d1df065822bbf14b787f0b98b4c2d2734118e2a710febb7a3aa
jws7-tomcat-admin-webapps-11.0.21-10.redhat_00010.1.el9jws.noarch.rpm SHA-256: 4dd2bc0eccfa78195c3740850122ebf1013c8cd1f62aedc8faa19a77d5697f0a
jws7-tomcat-docs-webapp-11.0.21-10.redhat_00010.1.el9jws.noarch.rpm SHA-256: adba8626bc3e3493a06843d8f19346175276de40b932c44bc6dc4952be22766f
jws7-tomcat-el-5.0-api-11.0.21-10.redhat_00010.1.el9jws.noarch.rpm SHA-256: 7f0d03d06d02a3b68485e3b17a254d6e5dc3525dab98d811b54115ea2a59abef
jws7-tomcat-javadoc-11.0.21-10.redhat_00010.1.el9jws.noarch.rpm SHA-256: bebcc3316e0d2ca8e3f0fd0b9eced823a3fb16e57704b7da61a8ce5083ea7be2
jws7-tomcat-jsp-3.1-api-11.0.21-10.redhat_00010.1.el9jws.noarch.rpm SHA-256: 990c3fd4dec53932968e8f4b2ed1faf84ab14ae3e4c6ccb2862e4e4298847d9a
jws7-tomcat-lib-11.0.21-10.redhat_00010.1.el9jws.noarch.rpm SHA-256: a065265e32e0eec487e169e9cc379c83ee5ea6e67b69357b0d4eca75f04df0da
jws7-tomcat-native-1.3.7-4.redhat_4.el9jws.x86_64.rpm SHA-256: 4e5b66c7410e269ef0723276b263791a4f017a79784f0828b7652803c96f0c3a
jws7-tomcat-native-debuginfo-1.3.7-4.redhat_4.el9jws.x86_64.rpm SHA-256: b16c73f7d80f52b3bb1867277d2844ac7ad83f4f7fe9e3164e606e5a5fe33c60
jws7-tomcat-selinux-11.0.21-10.redhat_00010.1.el9jws.noarch.rpm SHA-256: ec6fe53590e1f464523ddc45b15d27392f94bf9815cb1c1b87be5e1c3d8687e7
jws7-tomcat-servlet-6.0-api-11.0.21-10.redhat_00010.1.el9jws.noarch.rpm SHA-256: bbf12bfcf57d9e0dcdc942020ebaa8244245745978af4f380b669c0b54a65a0f
jws7-tomcat-webapps-11.0.21-10.redhat_00010.1.el9jws.noarch.rpm SHA-256: dd29ff14df1ae59fdfa3c606e75ef8e24b2220350899ead114956d886bbefa31

JBoss Enterprise Web Server 7 for RHEL 8

SRPM
jws7-mod_cluster-2.1.1-1.Final_redhat_00001.1.el8jws.src.rpm SHA-256: c33556141023f388018cabdb415eb4e3507f77b7ded72266abc5d64729793d05
jws7-tomcat-11.0.21-10.redhat_00010.1.el8jws.src.rpm SHA-256: 88349985115f5a9e7ead25a8c1ba6888847bd23f938c66e8574258fbb98541ce
jws7-tomcat-native-1.3.7-4.redhat_4.el8jws.src.rpm SHA-256: 62a691aac81eb9dcba471ead7f491f460cb13e9863f19e75d0a777df9600a9a5
x86_64
jws7-mod_cluster-2.1.1-1.Final_redhat_00001.1.el8jws.noarch.rpm SHA-256: c60a39b096cab3afca58ddf04e1e85ebfd2965259fecc9cfee08da7b13d80f44
jws7-mod_cluster-tomcat-2.1.1-1.Final_redhat_00001.1.el8jws.noarch.rpm SHA-256: cfecd5c06d06717cb46bc4c3e1fb36ae0a7028ca6dd501f4036d99fd34740616
jws7-tomcat-11.0.21-10.redhat_00010.1.el8jws.noarch.rpm SHA-256: 09be5f4206e89d73193d7934f943b9e3b008e7bf68550a13d0356132afd2c341
jws7-tomcat-admin-webapps-11.0.21-10.redhat_00010.1.el8jws.noarch.rpm SHA-256: 6a30e02d1937a15632ff06daacf67f17b64fcde67a5bedec3c19c581be203de8
jws7-tomcat-docs-webapp-11.0.21-10.redhat_00010.1.el8jws.noarch.rpm SHA-256: 371ed2695ca54cf88aa90b14ad42707a4d8da988d991a1d173fee0b1d9798031
jws7-tomcat-el-5.0-api-11.0.21-10.redhat_00010.1.el8jws.noarch.rpm SHA-256: b486a2b59ed2741fb25436177f192b0653e92d1ac9a97b3e53008b7788a2c454
jws7-tomcat-javadoc-11.0.21-10.redhat_00010.1.el8jws.noarch.rpm SHA-256: ab8ea54dac22c2c63f0f68de9aa3236720d361ff005c6e9c2555339591e985af
jws7-tomcat-jsp-3.1-api-11.0.21-10.redhat_00010.1.el8jws.noarch.rpm SHA-256: 6452e842acf472efa0ddde1b2295f0751c8949f2f2989d9f3788a9fd4871e50b
jws7-tomcat-lib-11.0.21-10.redhat_00010.1.el8jws.noarch.rpm SHA-256: 155083f39edf275ab862711e0cee6d16ef3f2e781b22e770d5d51a21756fc6fd
jws7-tomcat-native-1.3.7-4.redhat_4.el8jws.x86_64.rpm SHA-256: de348359826f9c656cd5662a46d3fe97a4d70086fb980eb1df2a9c552a524161
jws7-tomcat-native-debuginfo-1.3.7-4.redhat_4.el8jws.x86_64.rpm SHA-256: 6489b75ba3ce1ada0eb9a95cdebf17a1a0420ddf7b3ff8472b2cb8a9b5743d17
jws7-tomcat-selinux-11.0.21-10.redhat_00010.1.el8jws.noarch.rpm SHA-256: 12974bf51b306dc02041ebdf708da3cc051b5a035c50038e31b3380038ead774
jws7-tomcat-servlet-6.0-api-11.0.21-10.redhat_00010.1.el8jws.noarch.rpm SHA-256: a219eb3e2dbac2f2c3d562d27d6f7c49dab76ef5f48e4b0791da2344b05d5a37
jws7-tomcat-webapps-11.0.21-10.redhat_00010.1.el8jws.noarch.rpm SHA-256: b161d598636aa0f1eee61fb1638bcc0094bef5d698695af1e9d0eef9b73654b9

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.