RHSA-2026:2994HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP3 security update

Published
February 23, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (6)

CVE-2025-69419 →CVE-2025-9230 →CVE-2025-55753 →CVE-2025-58098 →CVE-2025-65082 →CVE-2025-66200 →

📋 Description

CVE-2025-9230 — openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-55753 — mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals CVE-2025-58098 — httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... CVE-2025-65082 — httpd: Apache HTTP Server: CGI environment variable override CVE-2025-66200 — httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo CVE-2025-69419 — openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing

🎯 Affected products106

  • Red Hat JBoss Core Services on RHEL 7 Server
  • Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-0:1.6.3-4.el7jbcs.src as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-0:1.6.3-4.el7jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-0:1.6.3-4.el8jbcs.src as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-debuginfo-0:1.6.3-4.el7jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-debuginfo-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-devel-0:1.6.3-4.el7jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-devel-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-ldap-0:1.6.3-4.el7jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-ldap-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-ldap-debuginfo-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-mysql-0:1.6.3-4.el7jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-mysql-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-mysql-debuginfo-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-nss-0:1.6.3-4.el7jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-nss-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-nss-debuginfo-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-odbc-0:1.6.3-4.el7jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-odbc-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-odbc-debuginfo-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-openssl-0:1.6.3-4.el7jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-openssl-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-openssl-debuginfo-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-pgsql-0:1.6.3-4.el7jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-pgsql-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-pgsql-debuginfo-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • jbcs-httpd24-apr-util-sqlite-0:1.6.3-4.el7jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-apr-util-sqlite-0:1.6.3-4.el8jbcs.x86_64 as a component of Red Hat JBoss Core Services on RHEL 8
  • +76 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, Red Hat recommends avoiding the processing of PKCS#12 files from untrusted or unverified sources. Applications that use the `PKCS12_get_friendlyname()` API should ensure that PKCS#12 files are only processed if they originate from trusted entities. Restricting the input sources for PKCS#12 files can significantly reduce the attack surface for this flaw.

🔗 References (10)