RHSA-2026:2995HighCVSS 9.8

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP3 security update

Published
February 23, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (7)

CVE-2025-69419 →CVE-2025-9230 →CVE-2025-15467 →CVE-2025-55753 →CVE-2025-58098 →CVE-2025-65082 →CVE-2025-66200 →

📋 Description

CVE-2025-9230 — openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-15467 — openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing CVE-2025-55753 — mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals CVE-2025-58098 — httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... CVE-2025-65082 — httpd: Apache HTTP Server: CGI environment variable override CVE-2025-66200 — httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo CVE-2025-69419 — openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing

🎯 Affected products1

  • Red Hat JBoss Core Services 2.4.62.SP3

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link. You must be logged in to download the update. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this vulnerability, Red Hat recommends avoiding the processing of PKCS#12 files from untrusted or unverified sources. Applications that use the `PKCS12_get_friendlyname()` API should ensure that PKCS#12 files are only processed if they originate from trusted entities. Restricting the input sources for PKCS#12 files can significantly reduce the attack surface for this flaw.

🔗 References (11)