Red Hat JBoss Web Server 6 vulnerabilities

6 known vulnerabilities in Red Hat JBoss Web Server 6 from Red Hat. 6 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  OpenSSL: Use After Free

  CVE-2026-45447Jun 9, 2026OpenSSLEPSS 4%

  Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When

• 7.3 High severity

  Apache HttpClient: Missing Critical Step in Authentication

  CVE-2026-40542Apr 22, 2026Apache

  Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes thi

• 9.1 Critical severity

  Eclipse Jetty: Inconsistent Interpretation of HTTP Requests

  CVE-2026-2332Apr 14, 2026Eclipse FoundationEPSS 1.36%

  In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html

• 7.5 High severity

  Apache Tomcat Missing Encryption of Sensitive Data Exploited

  CVE-2026-34486Apr 9, 2026ApacheEPSS 98.5%

  Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.2

• 8.8 High severity

  Red Hat build of Apache Camel 4.18.1 for…: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-67030Mar 25, 2026Red Hat

  Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

• 7.5 High severity

  Eclipse Jetty: Missing Release of Memory after Effective Lifetime

  CVE-2026-1605Mar 5, 2026Eclipse Foundation

  In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Infl