RHSA-2026:68651
Vulnerability from csaf_opensuse - Published: 2026-09-18 10:11 - Updated: 2026-09-29 17:27Summary
Red Hat Security Advisory: tomcat9 security update
Severity
Moderate
Notes
Topic: An update for tomcat9 is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.
Security Fix(es):
* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)
* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue (CVE-2025-66614). This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application.
7.3 (High)
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service (DoS), making the affected system unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Important
Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid.
7.3 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks.
5.3 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. The AJP secret was comparable in non-constant time, allowing an attacker on the local network to mount a timing attack to determine the AJP secret, which may lead to unauthorized access or other security bypasses.
CWE-208 - Observable Timing DiscrepancyAffected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Low
In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application.
5.4 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting (XSS), allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to unauthorized access to sensitive information or allow an attacker to alter the content of the website.
5.4 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
A flaw was found in Apache Tomcat's rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended rule processing, potentially allowing for security bypasses or unauthorized access due to misapplied configurations.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists (CRLs) for a FFM (presumably a specific type of connector), the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security controls might not be properly enforced.
CWE-390 - Detection of Error Condition Without ActionAffected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Low
A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might misinterpret the actual authorization constraints, potentially impacting the security posture of the application.
CWE-778 - Insufficient LoggingAffected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Low
A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component.
4.2 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding (hex encoding). A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actions that should be restricted.
CWE-807 - Reliance on Untrusted Inputs in a Security DecisionAffected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Low
A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance, potentially compromising the confidentiality or integrity of data processed by the affected system.
CWE-1188 - Initialization of a Resource with an Insecure DefaultAffected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Low
References
91 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for tomcat9 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.\n\nSecurity Fix(es):\n\n* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n\n* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n\n* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n\n* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n\n* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n\n* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n\n* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n\n* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:68651",
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "2457025",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457025"
},
{
"category": "external",
"summary": "2476511",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476511"
},
{
"category": "external",
"summary": "2476513",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476513"
},
{
"category": "external",
"summary": "2476516",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476516"
},
{
"category": "external",
"summary": "2476519",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476519"
},
{
"category": "external",
"summary": "2476520",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476520"
},
{
"category": "external",
"summary": "2499917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499917"
},
{
"category": "external",
"summary": "2499931",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499931"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68651.json"
}
],
"title": "Red Hat Security Advisory: tomcat9 security update",
"tracking": {
"current_release_date": "2026-09-29T17:27:58+00:00",
"generator": {
"date": "2026-09-29T17:27:58+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:68651",
"initial_release_date": "2026-09-18T10:11:34+00:00",
"revision_history": [
{
"date": "2026-09-18T10:11:34+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-18T10:11:34+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-29T17:27:58+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat9-1:9.0.120-1.el10_2.noarch",
"product": {
"name": "tomcat9-1:9.0.120-1.el10_2.noarch",
"product_id": "tomcat9-1:9.0.120-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9@9.0.120-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"product": {
"name": "tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"product_id": "tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-admin-webapps@9.0.120-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"product": {
"name": "tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"product_id": "tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-docs-webapp@9.0.120-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"product": {
"name": "tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"product_id": "tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-el-3.0-api@9.0.120-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"product": {
"name": "tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"product_id": "tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-jsp-2.3-api@9.0.120-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"product": {
"name": "tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"product_id": "tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-lib@9.0.120-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"product": {
"name": "tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"product_id": "tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-servlet-4.0-api@9.0.120-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-webapps-1:9.0.120-1.el10_2.noarch",
"product": {
"name": "tomcat9-webapps-1:9.0.120-1.el10_2.noarch",
"product_id": "tomcat9-webapps-1:9.0.120-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-webapps@9.0.120-1.el10_2?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat9-1:9.0.120-1.el10_2.src",
"product": {
"name": "tomcat9-1:9.0.120-1.el10_2.src",
"product_id": "tomcat9-1:9.0.120-1.el10_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9@9.0.120-1.el10_2?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-1:9.0.120-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch"
},
"product_reference": "tomcat9-1:9.0.120-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-1:9.0.120-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src"
},
"product_reference": "tomcat9-1:9.0.120-1.el10_2.src",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch"
},
"product_reference": "tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch"
},
"product_reference": "tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch"
},
"product_reference": "tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch"
},
"product_reference": "tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-lib-1:9.0.120-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch"
},
"product_reference": "tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch"
},
"product_reference": "tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-webapps-1:9.0.120-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
},
"product_reference": "tomcat9-webapps-1:9.0.120-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32990",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2026-04-09T20:01:19.299996+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457025"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue (CVE-2025-66614). This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact. This improper input validation vulnerability in Apache Tomcat, stemming from an incomplete fix for CVE-2025-66614, affects Red Hat JBoss Web Server and Red Hat Enterprise Linux. An attacker could exploit this flaw to bypass security controls or induce unexpected application behavior.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32990"
},
{
"category": "external",
"summary": "RHBZ#2457025",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457025"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32990"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32990",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32990"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7",
"url": "https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7"
}
],
"release_date": "2026-04-09T19:23:49.618000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix"
},
{
"cve": "CVE-2026-41284",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-12T16:01:43.841831+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476518"
}
],
"notes": [
{
"category": "description",
"text": "In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service (DoS), making the affected system unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41284"
},
{
"category": "external",
"summary": "RHBZ#2476518",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476518"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41284"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc",
"url": "https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc"
}
],
"release_date": "2026-05-12T15:14:45.278000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation"
},
{
"cve": "CVE-2026-41293",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-05-12T16:01:31.003990+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476513"
}
],
"notes": [
{
"category": "description",
"text": "Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41293"
},
{
"category": "external",
"summary": "RHBZ#2476513",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476513"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41293",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41293"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41293",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41293"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r",
"url": "https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r"
}
],
"release_date": "2026-05-12T15:19:35.179000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated"
},
{
"cve": "CVE-2026-42498",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-05-12T16:01:38.872167+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476516"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42498"
},
{
"category": "external",
"summary": "RHBZ#2476516",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476516"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42498",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42498"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42498",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42498"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb",
"url": "https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb"
}
],
"release_date": "2026-05-12T15:17:56.531000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication."
},
{
"cve": "CVE-2026-43512",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-05-12T16:01:26.008892+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476511"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password \"null\". This allows a remote attacker to bypass security controls.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Apache Tomcat allows an authentication bypass when DIGEST authentication is configured. An attacker can authenticate as any unknown user by providing the password \u0027null\u0027, potentially gaining unauthorized access to applications protected by DIGEST authentication. Red Hat products are only affected if they are configured to use DIGEST authentication, which is not a common, out of the box and expected configuration for Production environments. \n\nFurthermore, because the unknown user is not mapped to any valid realm roles, their access is still restricted by standard application authorization constraints, significantly limiting the actual impact.\n\nThe unknown user is not mapped to any existing user, which means, it does not steal credentials nor impersonate an existing user. This new user is expected to have the minimum possible authentication and authorization range within the realm inherited roles.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43512"
},
{
"category": "external",
"summary": "RHBZ#2476511",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476511"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43512"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73",
"url": "https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73"
}
],
"release_date": "2026-05-12T15:24:02.424000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable DIGEST authentication within Apache Tomcat if it is not essential for your environment. This involves modifying the server\u0027s authentication configuration to utilize alternative methods or remove the DIGEST realm. A service restart is required for these changes to take effect and may impact functionality relying on DIGEST authentication.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication"
},
{
"cve": "CVE-2026-43513",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-05-12T16:01:48.767743+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476520"
}
],
"notes": [
{
"category": "description",
"text": "In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache Tomcat\u0027s LockOutRealm. When configured with an underlying Realm where usernames are case-insensitive, the LockOutRealm does not account for case differences, potentially reducing the effectiveness of brute-force protection. Exploitation requires LockOutRealm to be configured with a case-insensitive authentication backend, which is a non-default configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43513"
},
{
"category": "external",
"summary": "RHBZ#2476520",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476520"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43513"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp",
"url": "https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp"
}
],
"release_date": "2026-05-12T15:26:25.599000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
},
{
"category": "workaround",
"details": "This vulnerability only affects Tomcat deployments using the LockOutRealm with a case-insensitive authentication backend. Deployments not using LockOutRealm or using case-sensitive authentication backends are not affected.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm"
},
{
"cve": "CVE-2026-43514",
"cwe": {
"id": "CWE-208",
"name": "Observable Timing Discrepancy"
},
"discovery_date": "2026-05-12T16:01:28.665836+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476512"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. The AJP secret was comparable in non-constant time, allowing an attacker on the local network to mount a timing attack to determine the AJP secret, which may lead to unauthorized access or other security bypasses.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43514"
},
{
"category": "external",
"summary": "RHBZ#2476512",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476512"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43514"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43514",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43514"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m",
"url": "https://lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m"
}
],
"release_date": "2026-05-12T15:32:09.858000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy"
},
{
"cve": "CVE-2026-43515",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-05-12T16:01:46.217175+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476519"
}
],
"notes": [
{
"category": "description",
"text": "In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-coyote: tomcat: Improper Authorization allows security bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43515"
},
{
"category": "external",
"summary": "RHBZ#2476519",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476519"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43515"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb",
"url": "https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb"
}
],
"release_date": "2026-05-12T15:33:23.311000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass"
},
{
"cve": "CVE-2026-50229",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-06-29T21:02:24.415552+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494688"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting (XSS), allows a remote attacker to inject malicious scripts into the \u0027number guess example\u0027 web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to unauthorized access to sensitive information or allow an attacker to alter the content of the website.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache Tomcat. A Cross-Site Scripting (XSS) vulnerability exists in the \"number guess\" example web application shipped with Tomcat. An attacker can inject malicious scripts into the example page, which execute in other users\u0027 browsers when they view the page. This vulnerability only affects the example web application, not the Tomcat servlet container itself. Red Hat Tomcat packages do not deploy example applications by default \u2014 they are in separate optional packages (e.g., tomcat-webapps) that are not installed in production environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50229"
},
{
"category": "external",
"summary": "RHBZ#2494688",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494688"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50229",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50229"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50229",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50229"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0",
"url": "https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0"
}
],
"release_date": "2026-06-29T20:36:24.683000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
},
{
"category": "workaround",
"details": "Remove or disable the Tomcat example web applications if they are deployed. Example applications are not needed for production use and should not be accessible in production environments.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example"
},
{
"cve": "CVE-2026-53404",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2026-06-29T21:01:58.363486+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494681"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat\u0027s rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended rule processing, potentially allowing for security bypasses or unauthorized access due to misapplied configurations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache Tomcat\u0027s RewriteValve. When rewrite rules use OR-chained conditions followed by non-OR conditions, the processing logic may not evaluate conditions correctly, potentially allowing unintended rule matches. Exploitation requires the RewriteValve to be enabled with specific OR-chained condition patterns, which is not a default configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53404"
},
{
"category": "external",
"summary": "RHBZ#2494681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53404"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53404",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53404"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz",
"url": "https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz"
}
],
"release_date": "2026-06-29T20:39:45.317000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
},
{
"category": "workaround",
"details": "This vulnerability only affects Tomcat deployments that use the RewriteValve with OR-chained rewrite conditions. Deployments that do not use the RewriteValve are not affected. Review rewrite rules for OR-chained conditions and test rule evaluation behavior.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing"
},
{
"cve": "CVE-2026-53434",
"cwe": {
"id": "CWE-390",
"name": "Detection of Error Condition Without Action"
},
"discovery_date": "2026-06-29T21:01:05.687650+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494668"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists (CRLs) for a FFM (presumably a specific type of connector), the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security controls might not be properly enforced.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Error condition not handled when configuring CRLs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw in Apache Tomcat\u0027s FFM-based connector causes errors loading configured Certificate Revocation Lists (CRLs) to be ignored, which could allow certificates that should be rejected to be accepted. Upstream affected versions are 9.0.83 through 9.0.118, 10.1.0-M7 through 10.1.55, and 11.0.0-M1 through 11.0.22. The affected path requires the FFM connector and CRL-based certificate revocation checking with invalid CRL data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53434"
},
{
"category": "external",
"summary": "RHBZ#2494668",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494668"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53434",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53434"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk",
"url": "https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk"
}
],
"release_date": "2026-06-29T20:41:06.948000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
},
{
"category": "workaround",
"details": "This vulnerability only affects Tomcat deployments using the FFM-based connector (requires Java 22+) with CRL-based certificate revocation checking. Deployments using the standard NIO/NIO2 connectors or not using CRL checking are not affected.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Apache Tomcat: Error condition not handled when configuring CRLs"
},
{
"cve": "CVE-2026-55276",
"cwe": {
"id": "CWE-778",
"name": "Insufficient Logging"
},
"discovery_date": "2026-06-29T21:01:38.615799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494675"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might misinterpret the actual authorization constraints, potentially impacting the security posture of the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache Tomcat. When the effective web.xml logging feature is enabled for debugging, special roles and empty authorization constraints may be omitted from the logged output. This is a logging-only issue with no runtime security impact \u2014 it only affects the accuracy of debug log output for administrators reviewing the effective web.xml configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55276"
},
{
"category": "external",
"summary": "RHBZ#2494675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55276"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55276",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55276"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v",
"url": "https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v"
}
],
"release_date": "2026-06-29T20:42:23.257000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
},
{
"category": "workaround",
"details": "This is a logging-only issue with no runtime security impact. No mitigation is required. Administrators should not rely solely on the effective web.xml debug log output to verify security constraint configuration.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow"
},
{
"cve": "CVE-2026-55955",
"cwe": {
"id": "CWE-294",
"name": "Authentication Bypass by Capture-replay"
},
"discovery_date": "2026-06-29T21:01:48.701284+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache Tomcat\u0027s EncryptionInterceptor used for Tribes cluster communication. An improper authentication vulnerability allows a replay attack against encrypted cluster messages. Exploitation requires the EncryptionInterceptor to be configured for Tomcat clustering, which is a non-default configuration, and the attacker must have access to the cluster network to capture and replay messages. Apache rates this vulnerability as Low severity. Red Hat has corrected the impact from IMPORTANT to MODERATE \u2014 the original AI-Bot CVSS of 8.2 (AV:N/AC:L) incorrectly scored this as internet-facing with low complexity, when Tribes cluster traffic is adjacent-network (AV:A) and requires non-default clustering configuration (AC:H). The corrected vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.2).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55955"
},
{
"category": "external",
"summary": "RHBZ#2494678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55955",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55955"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55955",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55955"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106",
"url": "https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106"
}
],
"release_date": "2026-06-29T20:44:39.779000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
},
{
"category": "workaround",
"details": "This vulnerability only affects Tomcat deployments using the EncryptionInterceptor for Tribes cluster communication. Deployments that do not use Tomcat clustering or do not configure the EncryptionInterceptor are not affected. Ensure cluster communication channels are restricted to trusted, isolated networks.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor"
},
{
"cve": "CVE-2026-55956",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-06-29T21:01:42.101197+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494676"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A security flaw in Apache Tomcat allows an attacker to bypass specific HTTP method restrictions on the default servlet. Red Hat products utilizing affected Tomcat versions are vulnerable if they rely on these method-specific security constraints. This could potentially enable unauthorized access to restricted application resources.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55956"
},
{
"category": "external",
"summary": "RHBZ#2494676",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494676"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55956"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55956",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55956"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp",
"url": "https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp"
}
],
"release_date": "2026-06-29T20:46:02.927000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
},
{
"category": "workaround",
"details": "Review your application\u0027s web.xml file. Ensure security constraints explicitly deny unauthorized users by path, rather than relying strictly on filtering specific HTTP methods (like GET or POST).",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass"
},
{
"cve": "CVE-2026-59083",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-07-14T09:01:06.476183+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499917"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding (hex encoding). A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actions that should be restricted.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Low impact vulnerability in Apache Tomcat\u0027s rewrite valve allows a security constraint bypass through improper URL encoding. Exploitation requires specific configurations and has high attack complexity, limiting its overall risk to Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59083"
},
{
"category": "external",
"summary": "RHBZ#2499917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499917"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59083",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59083"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59083",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59083"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq",
"url": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq"
}
],
"release_date": "2026-07-14T08:13:04.861000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
},
{
"category": "workaround",
"details": "To mitigate this issue, review Apache Tomcat\u0027s rewrite valve configurations. If the rewrite valve is not essential for your application, consider disabling it. If it is required, ensure its configuration does not permit improper URL encoding that could lead to security constraint bypasses. A service restart may be required for changes to take effect.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve"
},
{
"cve": "CVE-2026-59084",
"cwe": {
"id": "CWE-1188",
"name": "Initialization of a Resource with an Insecure Default"
},
"discovery_date": "2026-07-14T10:01:17.476740+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499931"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance, potentially compromising the confidentiality or integrity of data processed by the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Low impact vulnerability in Apache Tomcat arises from insufficient documentation for the EncryptInterceptor. Without clear guidance on secure configuration, administrators might inadvertently deploy the interceptor in a way that weakens security, rather than a direct code flaw. This issue affects Red Hat products utilizing Apache Tomcat, including Red Hat Enterprise Linux and Red Hat JBoss Web Server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59084"
},
{
"category": "external",
"summary": "RHBZ#2499931",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499931"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59084",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59084"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59084",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59084"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7",
"url": "https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7"
}
],
"release_date": "2026-07-14T08:24:21.531000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-18T10:11:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:68651"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that the EncryptInterceptor in Apache Tomcat is configured according to secure best practices. Review existing configurations of EncryptInterceptor to verify that all security requirements are met and that no insecure settings are in place. If the EncryptInterceptor is not actively used, no specific action is required.",
"product_ids": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.8,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-1:9.0.120-1.el10_2.src",
"AppStream-10.2.Z:tomcat9-admin-webapps-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-docs-webapp-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-el-3.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-lib-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_2.noarch",
"AppStream-10.2.Z:tomcat9-webapps-1:9.0.120-1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…