For our customers we don't replace the bundled 5.5.23 (or 20) by a 5.5.28 but we use the code in the repository. The repository contains all security patches to be as safe as a 5.5.28 Tomcat (and have be tested). If you really want to use 5.5.28 just build it and replace the jar files in your AS installation. Note that is not what JBoss supports so you may ended in troubles.... View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4262578#... Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...