Loading story…
Red Hat released JBoss Web Server 2.1.0 for Red Hat Enterprise Linux 5 and 6, replacing version 2.0.1 and addressing five Apache HTTP Server and Apache Tomcat vulnerabilities. The update fixes a mod_status heap-buffer-overflow issue that could enable remote code execution, denial-of-service flaws in mod_deflate and mod_cgid, and XML-processing weaknesses including XXE information disclosure.
The release also remediates CVE-2014-0119, in which a malicious application could, in limited circumstances, hijack XML parsers used by Tomcat/JBoss Web. This could bypass XXE restrictions and expose XML files handled by other applications on the same server instance. Red Hat advised affected users to apply prerequisite errata, back up applications and configurations, upgrade to JBoss Web Server 2.1.0, and restart the JBoss server process.
See real exploitation activity before you spend the cycle.
12 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2015:0991 for tomcat6 on RHEL 6 and RHSA-2015:0983 for Tomcat on RHEL 7, fixing the CVE-2014-0227 malformed chunked-request vulnerability that could enable request smuggling or limited denial of service.
Red Hat issued RHSA-2014:1087 and RHSA-2014:1088, making JBoss Web Server 2.1.0 available for RHEL 6 and RHEL 5, respectively. The updates replaced version 2.0.1 and remediated CVE-2014-0119 along with Apache HTTP Server and Tomcat flaws including CVE-2014-0226, CVE-2014-0118, CVE-2014-0231, and CVE-2013-4590.
Red Hat issued RHSA-2014:0842 and RHSA-2014:0843 to fix the XML-parser hijacking flaw in JBoss Enterprise Application Platform 6.2 deployments on RHEL 5 and RHEL 6.
Red Hat addressed the Apache Commons FileUpload/Tomcat 7 denial-of-service flaw (CVE-2014-0050) through updates for Fedora, RHEL, EAP, JBoss BRMS and BPM Suite, A-MQ, Fuse, Fuse Service Works, Operations Network, Enterprise Web Server, and JBoss Portal. The flaw could cause affected Tomcat 7 instances to loop indefinitely when processing a crafted multipart Content-Type header.
Red Hat addressed CVE-2014-0119 in JBoss Portal 6.2.0 through RHSA-2015:1009.
Red Hat addressed CVE-2014-0119 in Red Hat JBoss Fuse Service Works 6.0.0 through RHSA-2015:0720.
Red Hat issued RHSA-2015:0765 to remediate CVE-2014-0119 in Red Hat JBoss Data Virtualization 6.0.
Red Hat issued RHSA-2015:0675 to remediate CVE-2014-0119 in Red Hat JBoss Data Virtualization 6.1.
Red Hat issued RHSA-2015:0234 and RHSA-2015:0235 to address CVE-2014-0119 in Red Hat JBoss BPM Suite 6.0 and Red Hat JBoss BRMS 6.0.
Red Hat issued RHSA-2014:1038 to fix CVE-2014-0119 in the Tomcat6 component for Red Hat Enterprise Linux 6.
Red Hat issued RHSA-2014:1034 to remediate CVE-2014-0119 in the Tomcat component for Red Hat Enterprise Linux 7.
Red Hat issued RHSA-2014:0895, addressing CVE-2014-0119 in JBoss Data Grid 6.3.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
rhn.redhat.com
Open sourcerhn.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released JBoss Web Server `3.1.0` to replace version `3.0.3`, remediating 11 vulnerabilities in Apache Tomcat and Commons FileUpload. The most severe issue, **CVE-2016-8735**, could enable remote code execution through `JmxRemoteLifecycleListener` in Tomcat instances built from EWS 2.x or JWS 3.x source distributions; Red Hat noted that standard RHEL Tomcat binary packages were not affected. The update also fixes **CVE-2016-1240**, an unsafe Tomcat init-script file-handling flaw that could allow local privilege escalation via a symlink attack on `catalina.out`. Other fixes address writable Tomcat initialization configuration that could enable privilege escalation (`CVE-2016-6325`), SecurityManager bypasses and system-property disclosure (`CVE-2016-6794`), unauthorized access to global JNDI resources (`CVE-2016-6797`), username enumeration through timing differences (`CVE-2016-0762`), denial-of-service conditions, request or response manipulation, and information disclosure. Organizations running affected JBoss Web Server deployments should back up installations, applications, and configuration before upgrading; on RHEL 7, the `httpd` service restarts automatically after installation.
Aug 29, 2026
Red Hat released Moderate-impact updates for Apache Tomcat, JBoss Web Server, JBoss EAP 6.2.4, and JBoss Data Grid to remediate **CVE-2014-0075**, **CVE-2014-0099**, and **CVE-2014-0096**. The flaws could permit remote denial of service through unbounded chunked-transfer input, HTTP request smuggling via integer overflow while parsing `Content-Length` headers—particularly where a vulnerable server sits behind a reverse proxy—and XML external entity (XXE) processing in Tomcat DefaultServlet handling of user-supplied XSLTs. JBoss EAP and Data Grid updates additionally addressed XML parser abuse that could bypass XXE restrictions and expose XML files belonging to other applications on the same instance. Affected RHEL 6 and 7 Tomcat deployments, JBoss Web Server 2.0.1 installations, and EAP 6.2.4 environments should install the applicable vendor packages or upgrades and restart Tomcat or the JBoss server process. Red Hat supplied patched builds including `tomcat-7.0.42-6.el7_0` for RHEL 7 and `tomcat6-6.0.24-72.el6_5` for RHEL 6; JBoss Data Grid 6.2.1 users were directed to upgrade to 6.3.0. Administrators should back up JBoss installations, applications, and configurations before applying updates, and prioritize externally reachable services deployed behind reverse proxies.
Aug 29, 2026
Red Hat issued Moderate-security updates for JBoss Enterprise Application Platform (EAP) 6.2.2, JBoss Web Server 2.0.1, and RHEL `tomcat6` packages to address **CVE-2013-4286**, an HTTP request-processing flaw involving conflicting `Content-Length` and chunked-transfer headers. Successful exploitation could cause web-cache poisoning, cross-site scripting, or disclosure of data from other requests. The related Tomcat updates also remediate **CVE-2013-4322**, a resource-exhaustion denial of service in chunked-request processing, and **CVE-2014-0050**, an infinite-loop denial of service in embedded Apache Commons FileUpload; Tomcat 6 updates additionally address **CVE-2014-0033**, a URL-rewriting issue that could facilitate session hijacking. Red Hat instructed affected EAP, JBoss Web Server, and Tomcat administrators to install the supplied backported packages and restart the relevant server processes, preserving and merging local configuration changes where necessary. Separate JBoss middleware releases also delivered broader security fixes: JBoss Fuse 6.1.0 addressed issues including XML signature spoofing, XXE, authentication downgrade, denial of service, and credential exposure, while JBoss BRMS 6.0.3 corrected Important-severity flaws including potential remote code execution through Xalan-Java secure-processing bypasses, OpenSAML XXE, excessive Java Security Manager permissions, and plaintext request-parameter logging.
Aug 31, 2026