Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.0 security release

CVE-2026-2673 — openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group CVE-2026-29146 — Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-34486 — Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass CVE-2026-41284 — tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation CVE-2026-41293 — tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-42498 — tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. CVE-2026-43512 — tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43513 — tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm CVE-2026-43514 — tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy CVE-2026-43515 — tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-55956 — tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass