RHSA-2026:25341
Vulnerability from csaf_opensuse - Published: 2026-06-11 17:19 - Updated: 2026-09-30 14:07Summary
Red Hat Security Advisory: tomcat9 security update
Severity
Important
Notes
Topic: An update for tomcat9 is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.
Security Fix(es):
* tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)
* tomcat: Client certificate verification bypass due to virtual host mapping (CVE-2025-66614)
* tomcat: security constraint bypass with HTTP/0.9 (CVE-2026-24733)
* Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration (CVE-2026-29145)
* Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files (CVE-2026-34487)
* Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve (CVE-2026-25854)
* Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension (CVE-2026-24880)
* Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration (CVE-2026-34500)
* Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve (CVE-2026-34483)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field. The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.
5.3 (Medium)
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0.9 protocol can bypass the intended denial rule, enabling an attacker to access resources that should be protected.
CWE-20 - Improper Input ValidationAffected products
Fixed
9 products, the same list as for
CVE-2025-66614
Threats
Impact
Low
A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol (OCSP) responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability could allow an attacker to bypass certificate revocation checks, potentially leading to the acceptance of revoked certificates.
7.4 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2025-66614
Threats
Impact
Important
A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP requests are processed, potentially leading to the bypassing of security controls, cache poisoning, or other malicious activities.
4.3 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2025-66614
Threats
Impact
Low
A flaw was found in Apache Tomcat. This open redirect vulnerability allows an attacker to redirect a user to an untrusted site. This occurs through the LoadBalancerDrainingValve, which can be exploited to manipulate URL redirection. The primary impact is that users may be unknowingly directed to malicious websites, potentially leading to phishing attacks or other security compromises.
4.3 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2025-66614
Threats
Impact
Low
A flaw was found in Apache Tomcat and Apache Tomcat Native. When CLIENT_CERT authentication is configured with "soft fail" disabled, the authentication process may not correctly fail in certain scenarios. This vulnerability could allow an attacker to bypass expected client certificate authentication, potentially leading to unauthorized access to protected resources.
5.9 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2025-66614
Threats
Impact
Moderate
A flaw was found in the JsonAccessLogValve component of Apache Tomcat. This improper encoding or escaping of output vulnerability could allow an attacker to inject specially crafted data into log files. This could lead to information disclosure or other unintended consequences when the logs are processed or viewed.
5.4 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2025-66614
Threats
Impact
Low
A flaw was found in Apache Tomcat. The cloud membership for clustering component was vulnerable to the insertion of sensitive information into log files. This vulnerability could lead to the exposure of the Kubernetes bearer token, which is a credential used for authentication within a Kubernetes cluster, potentially allowing unauthorized access to cluster resources.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2025-66614
Threats
Impact
Low
A flaw was found in Apache Tomcat where OCSP-based certificate validation may incorrectly soft-fail during CLIENT_CERT authentication, even when soft-fail is disabled, under certain FFM-related execution paths. This can result in client certificates being accepted despite failed or unverifiable revocation checks, weakening certificate validation in specific mTLS configurations.
5.9 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2025-66614
Threats
Impact
Moderate
References
57 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for tomcat9 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)\n\n* tomcat: Client certificate verification bypass due to virtual host mapping (CVE-2025-66614)\n\n* tomcat: security constraint bypass with HTTP/0.9 (CVE-2026-24733)\n\n* Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration (CVE-2026-29145)\n\n* Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files (CVE-2026-34487)\n\n* Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve (CVE-2026-25854)\n\n* Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension (CVE-2026-24880)\n\n* Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration (CVE-2026-34500)\n\n* Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve (CVE-2026-34483)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:25341",
"url": "https://access.redhat.com/errata/RHSA-2026:25341"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2440426",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440426"
},
{
"category": "external",
"summary": "2440430",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440430"
},
{
"category": "external",
"summary": "2440437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440437"
},
{
"category": "external",
"summary": "2457037",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457037"
},
{
"category": "external",
"summary": "2457038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457038"
},
{
"category": "external",
"summary": "2457039",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457039"
},
{
"category": "external",
"summary": "2457040",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457040"
},
{
"category": "external",
"summary": "2457043",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457043"
},
{
"category": "external",
"summary": "2457044",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457044"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25341.json"
}
],
"title": "Red Hat Security Advisory: tomcat9 security update",
"tracking": {
"current_release_date": "2026-09-30T14:07:54+00:00",
"generator": {
"date": "2026-09-30T14:07:54+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:25341",
"initial_release_date": "2026-06-11T17:19:02+00:00",
"revision_history": [
{
"date": "2026-06-11T17:19:02+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-28T02:27:30+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-30T14:07:54+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat9-1:9.0.117-1.el10_2.noarch",
"product": {
"name": "tomcat9-1:9.0.117-1.el10_2.noarch",
"product_id": "tomcat9-1:9.0.117-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9@9.0.117-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"product": {
"name": "tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"product_id": "tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-admin-webapps@9.0.117-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"product": {
"name": "tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"product_id": "tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-docs-webapp@9.0.117-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"product": {
"name": "tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"product_id": "tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-el-3.0-api@9.0.117-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"product": {
"name": "tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"product_id": "tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-jsp-2.3-api@9.0.117-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"product": {
"name": "tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"product_id": "tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-lib@9.0.117-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"product": {
"name": "tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"product_id": "tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-servlet-4.0-api@9.0.117-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-webapps-1:9.0.117-1.el10_2.noarch",
"product": {
"name": "tomcat9-webapps-1:9.0.117-1.el10_2.noarch",
"product_id": "tomcat9-webapps-1:9.0.117-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-webapps@9.0.117-1.el10_2?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat9-1:9.0.117-1.el10_2.src",
"product": {
"name": "tomcat9-1:9.0.117-1.el10_2.src",
"product_id": "tomcat9-1:9.0.117-1.el10_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9@9.0.117-1.el10_2?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-1:9.0.117-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch"
},
"product_reference": "tomcat9-1:9.0.117-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-1:9.0.117-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src"
},
"product_reference": "tomcat9-1:9.0.117-1.el10_2.src",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch"
},
"product_reference": "tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch"
},
"product_reference": "tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch"
},
"product_reference": "tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch"
},
"product_reference": "tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-lib-1:9.0.117-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch"
},
"product_reference": "tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch"
},
"product_reference": "tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-webapps-1:9.0.117-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
},
"product_reference": "tomcat9-webapps-1:9.0.117-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-66614",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-02-17T20:04:14.943661+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2440430"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field. The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Client certificate verification bypass due to virtual host mapping",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-66614"
},
{
"category": "external",
"summary": "RHBZ#2440430",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440430"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-66614",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66614"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66614",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66614"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7",
"url": "https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7"
}
],
"release_date": "2026-02-17T18:48:30.577000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-11T17:19:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25341"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Client certificate verification bypass due to virtual host mapping"
},
{
"cve": "CVE-2026-24733",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-02-17T20:05:04.953085+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2440437"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0.9 protocol can bypass the intended denial rule, enabling an attacker to access resources that should be protected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security constraint bypass with HTTP/0.9",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when Tomcat is configured to allow HEAD requests but deny GET requests to the same resource, a very unlikely configuration. Due to this reason, this flaw has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-24733"
},
{
"category": "external",
"summary": "RHBZ#2440437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440437"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-24733",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24733"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24733",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24733"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f",
"url": "https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f"
}
],
"release_date": "2026-02-17T18:50:43.871000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-11T17:19:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25341"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that security constraints are consistent across similar methods (e.g., if GET is denied, HEAD should likely be denied) or block HTTP/0.9 traffic via a reverse proxy or firewall, if it is not required.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: security constraint bypass with HTTP/0.9"
},
{
"cve": "CVE-2026-24734",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-02-17T20:03:45.051629+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2440426"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol (OCSP) responder is used, the Tomcat Native component, and Tomcat\u0027s FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability could allow an attacker to bypass certificate revocation checks, potentially leading to the acceptance of revoked certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability doesn\u0027t affect the Apache Tomcat distributed with Red Hat Enterprise 8 and Red Hat Enterprise up to the version 9.7 as the vulnerable code is not built. The vulnerable code is compiled with Red Hat Enterprise Linux 9.8 and above.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-24734"
},
{
"category": "external",
"summary": "RHBZ#2440426",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440426"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-24734",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24734"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24734",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24734"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml",
"url": "https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml"
}
],
"release_date": "2026-02-17T18:53:12.228000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-11T17:19:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25341"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation"
},
{
"cve": "CVE-2026-24880",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-04-09T20:02:12.819168+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457040"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP requests are processed, potentially leading to the bypassing of security controls, cache poisoning, or other malicious activities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has a Low impact. A flaw in Apache Tomcat allows for HTTP Request/Response Smuggling through invalid chunk extensions. This could enable a remote attacker to bypass security controls or poison caches by manipulating HTTP request processing. This affects Red Hat Enterprise Linux and Red Hat JBoss Web Server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-24880"
},
{
"category": "external",
"summary": "RHBZ#2457040",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457040"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-24880",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24880"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24880",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24880"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn",
"url": "https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn"
}
],
"release_date": "2026-04-09T19:12:10.730000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-11T17:19:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25341"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension"
},
{
"cve": "CVE-2026-25854",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2026-04-09T20:02:10.027820+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457039"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. This open redirect vulnerability allows an attacker to redirect a user to an untrusted site. This occurs through the LoadBalancerDrainingValve, which can be exploited to manipulate URL redirection. The primary impact is that users may be unknowingly directed to malicious websites, potentially leading to phishing attacks or other security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Low impact vulnerability in Apache Tomcat allows for an open redirect through the LoadBalancerDrainingValve. An attacker could exploit this to redirect users to malicious websites, potentially leading to phishing. This affects Red Hat Enterprise Linux and Red Hat JBoss Web Server when Apache Tomcat is configured with the LoadBalancerDrainingValve.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25854"
},
{
"category": "external",
"summary": "RHBZ#2457039",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457039"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25854",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25854"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25854",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25854"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0",
"url": "https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0"
}
],
"release_date": "2026-04-09T19:13:13.529000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-11T17:19:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25341"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, disable or remove the LoadBalancerDrainingValve configuration from the server.xml file in your Apache Tomcat installation. This valve is typically configured within a \u003cHost\u003e or \u003cEngine\u003e element. After modifying server.xml, restart the Apache Tomcat service for the changes to take effect. This action may impact load balancing functionality if the valve is actively used for draining connections.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve"
},
{
"cve": "CVE-2026-29145",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-04-09T20:02:03.334498+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457037"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat and Apache Tomcat Native. When CLIENT_CERT authentication is configured with \"soft fail\" disabled, the authentication process may not correctly fail in certain scenarios. This vulnerability could allow an attacker to bypass expected client certificate authentication, potentially leading to unauthorized access to protected resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate vulnerability in Apache Tomcat and Apache Tomcat Native arises when CLIENT_CERT authentication is configured with \"soft fail\" disabled. This misconfiguration can lead to an authentication bypass, potentially allowing unauthorized access to protected resources. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10, along with Red Hat JBoss Web Server 5 and 6, are affected if running Apache Tomcat with this specific configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29145"
},
{
"category": "external",
"summary": "RHBZ#2457037",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457037"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29145"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz",
"url": "https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz"
}
],
"release_date": "2026-04-09T19:20:24.601000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-11T17:19:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25341"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that CLIENT_CERT authentication is configured to strictly enforce client certificate validation. Review the Apache Tomcat conf/server.xml configuration. For SSLHostConfig or Connector elements, set the clientAuth attribute to required or ensure softFail is enabled if optional client certificate authentication is desired. A restart of the Apache Tomcat service is necessary for these configuration changes to apply.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration"
},
{
"cve": "CVE-2026-34483",
"cwe": {
"id": "CWE-838",
"name": "Inappropriate Encoding for Output Context"
},
"discovery_date": "2026-04-09T20:02:26.870249+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457044"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the JsonAccessLogValve component of Apache Tomcat. This improper encoding or escaping of output vulnerability could allow an attacker to inject specially crafted data into log files. This could lead to information disclosure or other unintended consequences when the logs are processed or viewed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Low impact. A flaw in the Apache Tomcat JsonAccessLogValve component allows for improper encoding of output. This could enable an attacker to inject specially crafted data into log files, potentially leading to information disclosure or other unintended consequences during log processing. This affects Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34483"
},
{
"category": "external",
"summary": "RHBZ#2457044",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457044"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34483"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34483",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34483"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b",
"url": "https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b"
}
],
"release_date": "2026-04-09T19:30:28.874000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-11T17:19:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25341"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve"
},
{
"cve": "CVE-2026-34487",
"cwe": {
"id": "CWE-538",
"name": "Insertion of Sensitive Information into Externally-Accessible File or Directory"
},
"discovery_date": "2026-04-09T20:02:06.944382+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457038"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. The cloud membership for clustering component was vulnerable to the insertion of sensitive information into log files. This vulnerability could lead to the exposure of the Kubernetes bearer token, which is a credential used for authentication within a Kubernetes cluster, potentially allowing unauthorized access to cluster resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Low impact. This vulnerability in Apache Tomcat affects the cloud membership for clustering component, potentially exposing Kubernetes bearer tokens in log files. Exploitation requires the cloud membership feature to be enabled and an attacker to have access to the system\u0027s log files. Red Hat Enterprise Linux versions are affected if running Apache Tomcat with this specific clustering configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34487"
},
{
"category": "external",
"summary": "RHBZ#2457038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34487"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34487",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34487"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h",
"url": "https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h"
}
],
"release_date": "2026-04-09T19:36:12.048000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-11T17:19:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25341"
},
{
"category": "workaround",
"details": "Disable the cloud membership for clustering feature in Apache Tomcat if it is not actively used. Additionally, ensure that access to Apache Tomcat log files is strictly controlled and limited to authorized personnel only to prevent unauthorized disclosure of sensitive information. If the cloud membership for clustering feature is disabled, a restart of the Apache Tomcat service may be required for the changes to take effect.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files"
},
{
"cve": "CVE-2026-34500",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-04-09T20:02:23.809649+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457043"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat where OCSP-based certificate validation may incorrectly soft-fail during CLIENT_CERT authentication, even when soft-fail is disabled, under certain FFM-related execution paths. This can result in client certificates being accepted despite failed or unverifiable revocation checks, weakening certificate validation in specific mTLS configurations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue only affects Tomcat builds with FFM support enabled. In Red Hat Enterprise Linux, this support is only available in Tomcat package in Red Hat Enterprise Linux versions 9.8 and later, and 10.2 and later, as the feature requires Java 22 or later.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34500"
},
{
"category": "external",
"summary": "RHBZ#2457043",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457043"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34500"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34500",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34500"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2",
"url": "https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2"
}
],
"release_date": "2026-04-09T19:36:52.857000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-11T17:19:02+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25341"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.117-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.117-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.117-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…