Loading story…
Red Hat released JBoss Web Server 3.1.0 to replace version 3.0.3, remediating 11 vulnerabilities in Apache Tomcat and Commons FileUpload. The most severe issue, CVE-2016-8735, could enable remote code execution through JmxRemoteLifecycleListener in Tomcat instances built from EWS 2.x or JWS 3.x source distributions; Red Hat noted that standard RHEL Tomcat binary packages were not affected. The update also fixes CVE-2016-1240, an unsafe Tomcat init-script file-handling flaw that could allow local privilege escalation via a symlink attack on catalina.out.
Other fixes address writable Tomcat initialization configuration that could enable privilege escalation (CVE-2016-6325), SecurityManager bypasses and system-property disclosure (CVE-2016-6794), unauthorized access to global JNDI resources (CVE-2016-6797), username enumeration through timing differences (CVE-2016-0762), denial-of-service conditions, request or response manipulation, and information disclosure. Organizations running affected JBoss Web Server deployments should back up installations, applications, and configuration before upgrading; on RHEL 7, the httpd service restarts automatically after installation.
See real exploitation activity before you spend the cycle.
11 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2017:2247 for the RHEL 7 Tomcat component, fixing CVE-2016-0762 username enumeration, CVE-2016-6794 system-property disclosure, and CVE-2016-6797 unauthorized global JNDI resource access.
Red Hat issued Moderate-severity RHSA-2017:1551, updating JBoss Enterprise Application Platform from 6.4.15 to 6.4.16. It addressed CVE-2017-2595 arbitrary-file reads through log-viewer path traversal and the CVE-2016-5018 and CVE-2016-6796 SecurityManager bypasses.
Red Hat issued RHSA-2017:0455, RHSA-2017:0456, and RHSA-2017:0457 to update affected JBoss Web Server 3 deployments to version 3.1.0. The updates remediated 11 Tomcat and Commons FileUpload vulnerabilities, including local privilege escalation, SecurityManager bypasses, JNDI access, request smuggling, information disclosure, and source-built JmxRemoteLifecycleListener RCE.
CVE-2016-6794 was publicly disclosed as a Tomcat configuration-file system-property replacement flaw. A malicious web application could bypass SecurityManager restrictions and read otherwise inaccessible system properties.
Red Hat released RHSA-2016:2045 for RHEL 6 tomcat6 and RHSA-2016:2046 for RHEL 7 tomcat, addressing CVE-2016-6325. The flaw allowed tomcat-group members or malicious deployed applications to exploit writable configuration files and escalate privileges.
Dawid Golunski released an advisory for CVE-2016-1240 affecting Debian-packaged Tomcat 6, 7, and 8. The vulnerable init script could be abused by a Tomcat-account attacker through symlinked log files to obtain root privileges.
CVE-2013-4286 was published for improper handling of inconsistent Content-Length and Transfer-Encoding headers in Tomcat HTTP and AJP connectors, enabling HTTP request-smuggling attacks.
CVE-2012-4431 was published for an Apache Tomcat CsrfPreventionFilter flaw affecting Tomcat 6 before 6.0.36 and Tomcat 7 before 7.0.32. Remote attackers could bypass CSRF protections by submitting a request without a session identifier.
CVE-2012-3546 was published for a RealmBase flaw in Tomcat 6 and 7 that could allow remote security-constraint bypasses when FORM authentication was enabled.
CVE-2010-1157 was published for an Apache Tomcat BASIC or DIGEST authentication issue that could expose a server hostname or IP address in the WWW-Authenticate realm field.
CVE-2008-0002 was published for an Apache Tomcat 6.0.0–6.0.15 flaw where an exception during parameter processing could associate parameters with the wrong request context and expose sensitive information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
22 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourceredhat.com
Open sourceredhat.com
Open sourcelegalhackers.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released JBoss Web Server 2.1.0 for Red Hat Enterprise Linux 5 and 6, replacing version 2.0.1 and addressing five Apache HTTP Server and Apache Tomcat vulnerabilities. The update fixes a `mod_status` heap-buffer-overflow issue that could enable remote code execution, denial-of-service flaws in `mod_deflate` and `mod_cgid`, and XML-processing weaknesses including XXE information disclosure. The release also remediates **CVE-2014-0119**, in which a malicious application could, in limited circumstances, hijack XML parsers used by Tomcat/JBoss Web. This could bypass XXE restrictions and expose XML files handled by other applications on the same server instance. Red Hat advised affected users to apply prerequisite errata, back up applications and configurations, upgrade to JBoss Web Server 2.1.0, and restart the JBoss server process.
Aug 29, 2026
Red Hat released updates for Apache Tomcat and JBoss Web Server deployments on RHEL 6 and RHEL 7 to remediate vulnerabilities spanning local privilege escalation, SecurityManager bypass, directory traversal and disclosure, sensitive-data exposure, and denial of service. On RHEL 6, writable Tomcat configuration files could allow the `tomcat` user—or a compromised web application—to gain root-level code execution through service lifecycle actions; older Tomcat code also allowed authenticated malicious applications to bypass SecurityManager isolation and list parent deployment directories. The updates also address a Commons FileUpload flaw, `CVE-2016-3092`, in which crafted multipart boundaries near the 4,096-byte buffer length could severely slow processing or crash affected Tomcat 7 and 8 applications. Later packages fixed username enumeration through Realm timing differences, SecurityManager bypasses, protected system-property exposure, and unauthorized access to global JNDI resources via `ResourceLinkFactory`; affected organizations should deploy the supported Red Hat Tomcat or JBoss Web Server package updates for their platform.
Aug 29, 2026
Red Hat issued Moderate-security updates for JBoss Enterprise Application Platform (EAP) 6.2.2, JBoss Web Server 2.0.1, and RHEL `tomcat6` packages to address **CVE-2013-4286**, an HTTP request-processing flaw involving conflicting `Content-Length` and chunked-transfer headers. Successful exploitation could cause web-cache poisoning, cross-site scripting, or disclosure of data from other requests. The related Tomcat updates also remediate **CVE-2013-4322**, a resource-exhaustion denial of service in chunked-request processing, and **CVE-2014-0050**, an infinite-loop denial of service in embedded Apache Commons FileUpload; Tomcat 6 updates additionally address **CVE-2014-0033**, a URL-rewriting issue that could facilitate session hijacking. Red Hat instructed affected EAP, JBoss Web Server, and Tomcat administrators to install the supplied backported packages and restart the relevant server processes, preserving and merging local configuration changes where necessary. Separate JBoss middleware releases also delivered broader security fixes: JBoss Fuse 6.1.0 addressed issues including XML signature spoofing, XXE, authentication downgrade, denial of service, and credential exposure, while JBoss BRMS 6.0.3 corrected Important-severity flaws including potential remote code execution through Xalan-Java secure-processing bypasses, OpenSAML XXE, excessive Java Security Manager permissions, and plaintext request-parameter logging.
Aug 31, 2026