Red Hat Product Errata RHSA-2026:96228 - Security Advisory
Issued:
2026-11-09
Updated:
2026-11-09

RHSA-2026:96228 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 6.2.6 release and security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Red Hat JBoss Web Server 6.2.6 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 6.2.6 serves as a replacement for Red Hat JBoss Web Server 6.2.5. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.

Security Fix(es):

  • mod_cluster-core: mod_cluster Advertise Listener: unauthenticated DoS via crafted multicast datagram (CVE-2026-76166)
  • jws6-tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition (CVE-2026-86247)
  • jws6-tomcat: Apache Tomcat: Denial of Service via AJP request (CVE-2026-78383)
  • jws6-tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close (CVE-2026-77791)
  • jws6-tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up (CVE-2026-86350)
  • jws6-tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints (CVE-2026-76183)
  • jws6-tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts (CVE-2026-79677)
  • jws6-tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists (CVE-2026-73581)
  • jws6-tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVE-2026-86248)
  • jws6-tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake (CVE-2026-86243)
  • jws6-tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration (CVE-2026-86246)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 6 for RHEL 10 x86_64
  • JBoss Enterprise Web Server 6 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 6 for RHEL 8 x86_64

Fixes

  • BZ - 2510883 - CVE-2026-76166 modcluster-core: mod_cluster Advertise Listener: unauthenticated DoS via crafted multicast datagram
  • BZ - 2539355 - CVE-2026-76183 tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints
  • BZ - 2539356 - CVE-2026-73581 tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists
  • BZ - 2539370 - CVE-2026-86350 tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up
  • BZ - 2539393 - CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition
  • BZ - 2539394 - CVE-2026-86246 tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration
  • BZ - 2539395 - CVE-2026-86243 tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake
  • BZ - 2539396 - CVE-2026-77791 tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close
  • BZ - 2539486 - CVE-2026-78383 tomcat: Apache Tomcat: Denial of Service via AJP request
  • BZ - 2539616 - CVE-2026-79677 tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts
  • BZ - 2542847 - CVE-2026-86248 tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

JBoss Enterprise Web Server 6 for RHEL 10

SRPM
jws6-mod_cluster-2.0.5-1.Final_redhat_00001.1.el10jws.src.rpm SHA-256: 198be44500c67de80381dd71aaa690ee7a048e868ccac852a014a72e3ba17296
jws6-tomcat-10.1.49-18.redhat_00018.1.el10jws.src.rpm SHA-256: 618cda617208958e645bee3e203cba43abd14bf60833c482b7f47f61676b0b66
jws6-tomcat-native-1.3.6-2.redhat_2.el10jws.src.rpm SHA-256: b47aaf0afcc292c1d0b5c3637f5e302f3447950600f584ef01c70e2afa66eedb
x86_64
jws6-mod_cluster-2.0.5-1.Final_redhat_00001.1.el10jws.noarch.rpm SHA-256: a3dc2f1ce80b6c804662ef90da7ea5e89cf7e9ecc397b65de4c020482cc8f674
jws6-mod_cluster-tomcat-2.0.5-1.Final_redhat_00001.1.el10jws.noarch.rpm SHA-256: 6fe4d054460a3e08775dab873f9da850848a994e9ed24ac718df01499aa88319
jws6-tomcat-10.1.49-18.redhat_00018.1.el10jws.noarch.rpm SHA-256: 454e18ada8c9bacdd53297285d9b2e979af6473e69da71fceb5e74307e0763c1
jws6-tomcat-admin-webapps-10.1.49-18.redhat_00018.1.el10jws.noarch.rpm SHA-256: a85bde983227ca4a7f8761bf642df6d25901c62c5c4c67a72fbc3330e5eec8e8
jws6-tomcat-docs-webapp-10.1.49-18.redhat_00018.1.el10jws.noarch.rpm SHA-256: 3cb88ac6ca853a02de63fc3565e605c15ddcd283516387460685e2ea4a7fe8bb
jws6-tomcat-el-5.0-api-10.1.49-18.redhat_00018.1.el10jws.noarch.rpm SHA-256: f232f8cfe6520a86ee08e066ccb4c66c4552112ec10e5fd7b478a0dda5909f05
jws6-tomcat-javadoc-10.1.49-18.redhat_00018.1.el10jws.noarch.rpm SHA-256: 4c4357ec8f8bcb10d1bb83b976d7e0c0b531319a2414c04d7f7f60444fb87fb1
jws6-tomcat-jsp-3.1-api-10.1.49-18.redhat_00018.1.el10jws.noarch.rpm SHA-256: 934455093bea939248dd2f4ac170f97cc41d47555727725df2caba653632c2e3
jws6-tomcat-lib-10.1.49-18.redhat_00018.1.el10jws.noarch.rpm SHA-256: 32244201ee11ff2ed5c58e10553880bb332b0221e69e45ec133e8ebcb69279b6
jws6-tomcat-native-1.3.6-2.redhat_2.el10jws.x86_64.rpm SHA-256: 7b7e22ccd32fd49a2379482357b6f6ce710a4851fa73ba0387403508264f4eb0
jws6-tomcat-native-debuginfo-1.3.6-2.redhat_2.el10jws.x86_64.rpm SHA-256: a0fc4f40bd0ae7e03a2c66c31a167946a9ab252764cab4a86ab8b4b816be453a
jws6-tomcat-selinux-10.1.49-18.redhat_00018.1.el10jws.noarch.rpm SHA-256: d3e60ed368b752c2446536c7325dc3477cf398754e779448111890ba05c7d171
jws6-tomcat-servlet-6.0-api-10.1.49-18.redhat_00018.1.el10jws.noarch.rpm SHA-256: 7259d6df28ccb75f76c9e56ad2f1be10194f3d9a6c56bf333cb15ba9a67d03c1
jws6-tomcat-webapps-10.1.49-18.redhat_00018.1.el10jws.noarch.rpm SHA-256: 3ef4be0cc877a60785525f3b0e9d1a40863400eea71bd383fa990b697d2372e3

JBoss Enterprise Web Server 6 for RHEL 9

SRPM
jws6-mod_cluster-2.0.5-1.Final_redhat_00001.1.el9jws.src.rpm SHA-256: 5c4db6640c4cd4dceea728fb3eb21049cdfd7c2a3d920e24e9a56372b4f5a209
jws6-tomcat-10.1.49-18.redhat_00018.1.el9jws.src.rpm SHA-256: a5a68130e69fe79af78786a44e2476be4f0d111c74d71a7476566382d6d5730d
jws6-tomcat-native-1.3.6-2.redhat_2.el9jws.src.rpm SHA-256: fb234822137ea32f45e9e46a46d76e83f78e3d9726c06e260324d1a1258017f6
x86_64
jws6-mod_cluster-2.0.5-1.Final_redhat_00001.1.el9jws.noarch.rpm SHA-256: b6312cc94ae59efe1d4e31e9760efd5d5cf7b2f9855f5cfa1f61a55c5e76b658
jws6-mod_cluster-tomcat-2.0.5-1.Final_redhat_00001.1.el9jws.noarch.rpm SHA-256: 2315f9d1ca48b53a6e85b45e9559570d9b493bdab233e84998ac4e07d1cc5e33
jws6-tomcat-10.1.49-18.redhat_00018.1.el9jws.noarch.rpm SHA-256: c260bb63d7de611f03a5bec46197ff126573d978a8b43a11c1d53f1d0e397d79
jws6-tomcat-admin-webapps-10.1.49-18.redhat_00018.1.el9jws.noarch.rpm SHA-256: fdd0bc332af3acc1afac4c0daae57556398aaf671eae926f757eca46cd7f231b
jws6-tomcat-docs-webapp-10.1.49-18.redhat_00018.1.el9jws.noarch.rpm SHA-256: 1909659be1d1ad72b8304a302576c07573cb54125e6be083355c737d4dec1dc7
jws6-tomcat-el-5.0-api-10.1.49-18.redhat_00018.1.el9jws.noarch.rpm SHA-256: f8db68597368b989803993fc767f5072daad18c53166d840533dcf553d752727
jws6-tomcat-javadoc-10.1.49-18.redhat_00018.1.el9jws.noarch.rpm SHA-256: c7931be76e3a01d30fa9ba2d50ac01ff86c8fd9891edadac36604761db0a9207
jws6-tomcat-jsp-3.1-api-10.1.49-18.redhat_00018.1.el9jws.noarch.rpm SHA-256: 7fa5c58221e858e2702244fc238595c20d9bd9eff0415aa09b8399dc78967491
jws6-tomcat-lib-10.1.49-18.redhat_00018.1.el9jws.noarch.rpm SHA-256: ccda220659d4fc527bd2c3cebd0799a04cb83da444b20ed0106053852493d259
jws6-tomcat-native-1.3.6-2.redhat_2.el9jws.x86_64.rpm SHA-256: 5db5950690238a444c71d540a86d1974ce2d584abbf09f5e934e206364c16b04
jws6-tomcat-native-debuginfo-1.3.6-2.redhat_2.el9jws.x86_64.rpm SHA-256: 03725ffd0564f2c9705691c4e88f3a9cadc9214532fa98767c7e1c3f9f561a05
jws6-tomcat-selinux-10.1.49-18.redhat_00018.1.el9jws.noarch.rpm SHA-256: c827b49cd2cb09667a028a7bf780b413f326011a2981d178b38ab207331defc1
jws6-tomcat-servlet-6.0-api-10.1.49-18.redhat_00018.1.el9jws.noarch.rpm SHA-256: 7f6ff492bbc6e08018ce49bc63146ad52924a3f95d9ca6ffebc28f27835216dd
jws6-tomcat-webapps-10.1.49-18.redhat_00018.1.el9jws.noarch.rpm SHA-256: e61d793926456bd1ccc40b104d75a704e0b54af2283a32bba32cd179ffb7fa39

JBoss Enterprise Web Server 6 for RHEL 8

SRPM
jws6-mod_cluster-2.0.5-1.Final_redhat_00001.1.el8jws.src.rpm SHA-256: f409348cb69b4ff36139718ce069492cf20f7c32eb8eba0b8cb34a422bbf68d4
jws6-tomcat-10.1.49-18.redhat_00018.1.el8jws.src.rpm SHA-256: ee732ab0eda91b73bd779b33c18f7a211017029c024ef309517a033051cf8a33
jws6-tomcat-native-1.3.6-2.redhat_2.el8jws.src.rpm SHA-256: d135c3c35821c0cc05a7f7e823c5363c2828b4b0fe01fe69ef2a85bfee758a92
x86_64
jws6-mod_cluster-2.0.5-1.Final_redhat_00001.1.el8jws.noarch.rpm SHA-256: 98095d54875d4682ca07e08ae0998753a8a5bf926083619c9e736af63633639b
jws6-mod_cluster-tomcat-2.0.5-1.Final_redhat_00001.1.el8jws.noarch.rpm SHA-256: 903464ebc6006bb52e138c4dc58d634faec44b3049cdd95770ee8ac76822c33d
jws6-tomcat-10.1.49-18.redhat_00018.1.el8jws.noarch.rpm SHA-256: a0ac10788d9b7112b6562a6157cf2003c9e68a03456158f1d0cd85974b9297f6
jws6-tomcat-admin-webapps-10.1.49-18.redhat_00018.1.el8jws.noarch.rpm SHA-256: 79cad6f74600db33f0d798d735d450a426fb3e3503dde7653e20408e6cf71f8b
jws6-tomcat-docs-webapp-10.1.49-18.redhat_00018.1.el8jws.noarch.rpm SHA-256: 83dcac178d39b85f439716467c7fd9d428c7acc3ab4171241bd83c8ce9d407a9
jws6-tomcat-el-5.0-api-10.1.49-18.redhat_00018.1.el8jws.noarch.rpm SHA-256: 99cf66e3739a315a3aafb015cb1a595b9d960be980755dc219299e43a742dfed
jws6-tomcat-javadoc-10.1.49-18.redhat_00018.1.el8jws.noarch.rpm SHA-256: 7177952be565e7131220b3c1cc6d58aa7a15519ac77b97b7ddc14d294e9e968f
jws6-tomcat-jsp-3.1-api-10.1.49-18.redhat_00018.1.el8jws.noarch.rpm SHA-256: f5a8962c277e02f5d1a3fc02de6b0b160f2fb4906d01a44a4130f890ee170c3b
jws6-tomcat-lib-10.1.49-18.redhat_00018.1.el8jws.noarch.rpm SHA-256: 8dad36c015d66138f9c694fcb3862fa42946bec7bd8ef50c5b3ad381cac13afb
jws6-tomcat-native-1.3.6-2.redhat_2.el8jws.x86_64.rpm SHA-256: 4865a1352a5548c9d2f89c1f41fabb162d3d74de4e2dacf46fffa95a84d9eae7
jws6-tomcat-native-debuginfo-1.3.6-2.redhat_2.el8jws.x86_64.rpm SHA-256: 0a18a5718bf91144d8520a372c16b2d3ffbc780ed13ce9ee80893c2798c1786f
jws6-tomcat-selinux-10.1.49-18.redhat_00018.1.el8jws.noarch.rpm SHA-256: e41e38869d5cf7abf4dff5205a4813e987db66e83d6230c0b14072c47049ddb0
jws6-tomcat-servlet-6.0-api-10.1.49-18.redhat_00018.1.el8jws.noarch.rpm SHA-256: 13caac9f3c1560f041c186102fbf3692bf1500876e623bcc93a690e5ad5741e6
jws6-tomcat-webapps-10.1.49-18.redhat_00018.1.el8jws.noarch.rpm SHA-256: 4c940a4e5672e7a887cc2557c42c7348132b90e9367cb2deb06c31884b45d51e

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.