RHSA-2026:73981

Vulnerability from csaf_redhat - Published: 2026-10-01 23:03 - Updated: 2026-10-01 23:42
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.5 release and security update
Severity
Important
Notes
Topic: Red Hat JBoss Web Server 6.2.5 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library. This release of Red Hat JBoss Web Server 6.2.5 serves as a replacement for Red Hat JBoss Web Server 6.2.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section. Security Fix(es): * tomcat-catalina: Apache Tomcat: Misleading security logs due to incorrect control flow (CVE-2026-55276) * tomcat-coyote-ffm: Apache Tomcat: Error condition not handled when configuring CRL (CVE-2026-53434) * jws6-tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) * tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183) * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) * tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763) * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525) * tomcat: Apache Tomcat - DoS in WebSocket chat example (CVE-2026-66299) * tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination (CVE-2026-73180) * tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints (CVE-2026-66422) * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569) * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-53434

A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists (CRLs) for a FFM (presumably a specific type of connector), the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security controls might not be properly enforced.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-390 - Detection of Error Condition Without Action
Affected products
Product Identifier Version Remediation
Unresolved product id: 10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src —
Vendor Fix fix
Workaround
Unresolved product id: 10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src —
Vendor Fix fix
Workaround
Unresolved product id: 8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch —
Vendor Fix fix
Workaround
Threats
Impact Low
CVE-2026-55276

A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might misinterpret the actual authorization constraints, potentially impacting the security posture of the application.

2.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CWE-778 - Insufficient Logging
Affected products
Fixed 33 products, the same list as for CVE-2026-53434
Threats
Impact Low
CVE-2026-59083

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding (hex encoding). A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actions that should be restricted.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-807 - Reliance on Untrusted Inputs in a Security Decision
Affected products
Fixed 33 products, the same list as for CVE-2026-53434
Threats
Impact Low
CVE-2026-65182

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potentially leading to unauthorized access to resources.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Fixed 33 products, the same list as for CVE-2026-53434
Threats
Impact Important
CVE-2026-65183

A flaw was found in Apache Tomcat. A Time-of-check Time-of-use (TOCTOU) race condition exists when creating Unix domain sockets. This vulnerability allows an unauthorized local user to exploit the timing window to gain access to the Unix domain socket. This could lead to information disclosure or other unauthorized operations.

2.5 (Low)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products
Fixed 33 products, the same list as for CVE-2026-53434
Threats
Impact Low
CVE-2026-65905

A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This allows the attacker to replay the request once, potentially bypassing authentication.

4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-294 - Authentication Bypass by Capture-replay
Affected products
Fixed 33 products, the same list as for CVE-2026-53434
Threats
Impact Moderate
CVE-2026-65927

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's [N] flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CWE-193 - Off-by-one Error
Affected products
Fixed 33 products, the same list as for CVE-2026-53434
Threats
Impact Important
CVE-2026-66299

A flaw was found in Apache Tomcat. This uncontrolled resource consumption vulnerability, located in the WebSocket chat example, allows a remote attacker to cause a Denial of Service (DoS) by exhausting system resources. This can lead to the affected system becoming unresponsive or crashing.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 33 products, the same list as for CVE-2026-53434
Threats
Impact Moderate
CVE-2026-66422

A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole(). This misconfiguration allows for a bypass of declarative role constraints, which could lead to unauthorized access to resources that should be restricted based on user roles.

2.7 (Low)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CWE-386 - Symbolic Name not Mapping to Correct Object
Affected products
Fixed 33 products, the same list as for CVE-2026-53434
Threats
Impact Low
CVE-2026-68525

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be restricted to POST requests only.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Fixed 33 products, the same list as for CVE-2026-53434
Threats
Impact Moderate
CVE-2026-68569

A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized access to the system.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CWE-305 - Authentication Bypass by Primary Weakness
Affected products
Fixed 33 products, the same list as for CVE-2026-53434
Threats
Impact Important
CVE-2026-68763

A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service (DoS), making the server unresponsive or unavailable to users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 33 products, the same list as for CVE-2026-53434
Threats
Impact Important
CVE-2026-73180

A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when the associated HTTP session ends. This could allow an attacker to maintain an active WebSocket session, potentially leading to unauthorized access or information disclosure.

5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-613 - Insufficient Session Expiration
Affected products
Fixed 33 products, the same list as for CVE-2026-53434
Threats
Impact Moderate
References
URL Category
https://access.redhat.com/errata/RHSA-2026:73981 self
https://access.redhat.com/security/updates/classi… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://bugzilla.redhat.com/show_bug.cgi?id=2494668 external
https://bugzilla.redhat.com/show_bug.cgi?id=2494675 external
https://bugzilla.redhat.com/show_bug.cgi?id=2499917 external
https://bugzilla.redhat.com/show_bug.cgi?id=2508085 external
https://bugzilla.redhat.com/show_bug.cgi?id=2524151 external
https://bugzilla.redhat.com/show_bug.cgi?id=2524153 external
https://bugzilla.redhat.com/show_bug.cgi?id=2524154 external
https://bugzilla.redhat.com/show_bug.cgi?id=2524156 external
https://bugzilla.redhat.com/show_bug.cgi?id=2524160 external
https://bugzilla.redhat.com/show_bug.cgi?id=2524161 external
https://bugzilla.redhat.com/show_bug.cgi?id=2524162 external
https://bugzilla.redhat.com/show_bug.cgi?id=2524165 external
https://bugzilla.redhat.com/show_bug.cgi?id=2524166 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-53434 self
https://bugzilla.redhat.com/show_bug.cgi?id=2494668 external
https://www.cve.org/CVERecord?id=CVE-2026-53434 external
https://nvd.nist.gov/vuln/detail/CVE-2026-53434 external
https://lists.apache.org/thread/x510lbq0sfrd1qyo7… external
https://access.redhat.com/security/cve/CVE-2026-55276 self
https://bugzilla.redhat.com/show_bug.cgi?id=2494675 external
https://www.cve.org/CVERecord?id=CVE-2026-55276 external
https://nvd.nist.gov/vuln/detail/CVE-2026-55276 external
https://lists.apache.org/thread/jy09xjlzn6r2qwvqo… external
https://access.redhat.com/security/cve/CVE-2026-59083 self
https://bugzilla.redhat.com/show_bug.cgi?id=2499917 external
https://www.cve.org/CVERecord?id=CVE-2026-59083 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59083 external
https://lists.apache.org/thread/3g63zos2gkjo5vgnr… external
https://access.redhat.com/security/cve/CVE-2026-65182 self
https://bugzilla.redhat.com/show_bug.cgi?id=2524151 external
https://www.cve.org/CVERecord?id=CVE-2026-65182 external
https://nvd.nist.gov/vuln/detail/CVE-2026-65182 external
https://lists.apache.org/thread/joosxvzc9b49ttj8l… external
https://access.redhat.com/security/cve/CVE-2026-65183 self
https://bugzilla.redhat.com/show_bug.cgi?id=2524153 external
https://www.cve.org/CVERecord?id=CVE-2026-65183 external
https://nvd.nist.gov/vuln/detail/CVE-2026-65183 external
https://lists.apache.org/thread/748o4st6d5dk6n3l7… external
https://access.redhat.com/security/cve/CVE-2026-65905 self
https://bugzilla.redhat.com/show_bug.cgi?id=2524161 external
https://www.cve.org/CVERecord?id=CVE-2026-65905 external
https://nvd.nist.gov/vuln/detail/CVE-2026-65905 external
https://lists.apache.org/thread/9v114xlpgbzrrbzz5… external
https://access.redhat.com/security/cve/CVE-2026-65927 self
https://bugzilla.redhat.com/show_bug.cgi?id=2524154 external
https://www.cve.org/CVERecord?id=CVE-2026-65927 external
https://nvd.nist.gov/vuln/detail/CVE-2026-65927 external
https://lists.apache.org/thread/st1dx1zyn5y7ny2s0… external
https://access.redhat.com/security/cve/CVE-2026-66299 self
https://bugzilla.redhat.com/show_bug.cgi?id=2508085 external
https://www.cve.org/CVERecord?id=CVE-2026-66299 external
https://nvd.nist.gov/vuln/detail/CVE-2026-66299 external
https://lists.apache.org/thread/8owczcc1o8qw1rxmg… external
https://access.redhat.com/security/cve/CVE-2026-66422 self
https://bugzilla.redhat.com/show_bug.cgi?id=2524156 external
https://www.cve.org/CVERecord?id=CVE-2026-66422 external
https://nvd.nist.gov/vuln/detail/CVE-2026-66422 external
https://lists.apache.org/thread/j5plylz1b2vhqvbkq… external
https://access.redhat.com/security/cve/CVE-2026-68525 self
https://bugzilla.redhat.com/show_bug.cgi?id=2524162 external
https://www.cve.org/CVERecord?id=CVE-2026-68525 external
https://nvd.nist.gov/vuln/detail/CVE-2026-68525 external
https://lists.apache.org/thread/x1y2lfsgzxwzc456f… external
https://access.redhat.com/security/cve/CVE-2026-68569 self
https://bugzilla.redhat.com/show_bug.cgi?id=2524160 external
https://www.cve.org/CVERecord?id=CVE-2026-68569 external
https://nvd.nist.gov/vuln/detail/CVE-2026-68569 external
https://lists.apache.org/thread/8robqo76q0osxgw0b… external
https://access.redhat.com/security/cve/CVE-2026-68763 self
https://bugzilla.redhat.com/show_bug.cgi?id=2524166 external
https://www.cve.org/CVERecord?id=CVE-2026-68763 external
https://nvd.nist.gov/vuln/detail/CVE-2026-68763 external
https://lists.apache.org/thread/tv51ty39ppv41v04h… external
https://access.redhat.com/security/cve/CVE-2026-73180 self
https://bugzilla.redhat.com/show_bug.cgi?id=2524165 external
https://www.cve.org/CVERecord?id=CVE-2026-73180 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73180 external
https://lists.apache.org/thread/3j15vztszpyqss253… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Web Server 6.2.5 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 6.2.5 serves as a replacement for Red Hat JBoss Web Server 6.2.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.\n\nSecurity Fix(es):\n\n* tomcat-catalina: Apache Tomcat: Misleading security logs due to incorrect control flow (CVE-2026-55276)\n* tomcat-coyote-ffm: Apache Tomcat: Error condition not handled when configuring CRL (CVE-2026-53434)\n* jws6-tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n* tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183)\n* tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)\n* tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)\n* tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)\n* tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)\n* tomcat: Apache Tomcat - DoS in WebSocket chat example (CVE-2026-66299)\n* tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination (CVE-2026-73180)\n* tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints (CVE-2026-66422)\n* tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)\n* tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:73981",
        "url": "https://access.redhat.com/errata/RHSA-2026:73981"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.2/html/red_hat_jboss_web_server_6.2_service_pack_5_release_notes/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.2/html/red_hat_jboss_web_server_6.2_service_pack_5_release_notes/index"
      },
      {
        "category": "external",
        "summary": "2494668",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494668"
      },
      {
        "category": "external",
        "summary": "2494675",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494675"
      },
      {
        "category": "external",
        "summary": "2499917",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499917"
      },
      {
        "category": "external",
        "summary": "2508085",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508085"
      },
      {
        "category": "external",
        "summary": "2524151",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524151"
      },
      {
        "category": "external",
        "summary": "2524153",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524153"
      },
      {
        "category": "external",
        "summary": "2524154",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524154"
      },
      {
        "category": "external",
        "summary": "2524156",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524156"
      },
      {
        "category": "external",
        "summary": "2524160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524160"
      },
      {
        "category": "external",
        "summary": "2524161",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524161"
      },
      {
        "category": "external",
        "summary": "2524162",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524162"
      },
      {
        "category": "external",
        "summary": "2524165",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524165"
      },
      {
        "category": "external",
        "summary": "2524166",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524166"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73981.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.5 release and security update",
    "tracking": {
      "current_release_date": "2026-10-01T23:42:12+00:00",
      "generator": {
        "date": "2026-10-01T23:42:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:73981",
      "initial_release_date": "2026-10-01T23:03:51+00:00",
      "revision_history": [
        {
          "date": "2026-10-01T23:03:51+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-01T23:03:51+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-01T23:42:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Server 6.2 on RHEL 10",
                "product": {
                  "name": "Red Hat JBoss Web Server 6.2 on RHEL 10",
                  "product_id": "10Base-JWS-6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.2::el10"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Server 6.2 on RHEL 8",
                "product": {
                  "name": "Red Hat JBoss Web Server 6.2 on RHEL 8",
                  "product_id": "8Base-JWS-6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.2::el8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Server 6.2 on RHEL 9",
                "product": {
                  "name": "Red Hat JBoss Web Server 6.2 on RHEL 9",
                  "product_id": "9Base-JWS-6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6.2::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Web Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
                "product": {
                  "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
                  "product_id": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.49-16.redhat_00016.1.el10jws?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
                "product": {
                  "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
                  "product_id": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.49-16.redhat_00016.1.el8jws?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
                "product": {
                  "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
                  "product_id": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.49-16.redhat_00016.1.el9jws?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                "product": {
                  "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_id": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.49-16.redhat_00016.1.el10jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                "product": {
                  "name": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_id": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-admin-webapps@10.1.49-16.redhat_00016.1.el10jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                "product": {
                  "name": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_id": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-docs-webapp@10.1.49-16.redhat_00016.1.el10jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                "product": {
                  "name": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_id": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-el-5.0-api@10.1.49-16.redhat_00016.1.el10jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                "product": {
                  "name": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_id": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-javadoc@10.1.49-16.redhat_00016.1.el10jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                "product": {
                  "name": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_id": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-jsp-3.1-api@10.1.49-16.redhat_00016.1.el10jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                "product": {
                  "name": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_id": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-lib@10.1.49-16.redhat_00016.1.el10jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                "product": {
                  "name": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_id": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-selinux@10.1.49-16.redhat_00016.1.el10jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                "product": {
                  "name": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_id": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-servlet-6.0-api@10.1.49-16.redhat_00016.1.el10jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                "product": {
                  "name": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_id": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-webapps@10.1.49-16.redhat_00016.1.el10jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                "product": {
                  "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_id": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.49-16.redhat_00016.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                "product": {
                  "name": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_id": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-admin-webapps@10.1.49-16.redhat_00016.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                "product": {
                  "name": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_id": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-docs-webapp@10.1.49-16.redhat_00016.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                "product": {
                  "name": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_id": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-el-5.0-api@10.1.49-16.redhat_00016.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                "product": {
                  "name": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_id": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-javadoc@10.1.49-16.redhat_00016.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                "product": {
                  "name": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_id": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-jsp-3.1-api@10.1.49-16.redhat_00016.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                "product": {
                  "name": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_id": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-lib@10.1.49-16.redhat_00016.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                "product": {
                  "name": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_id": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-selinux@10.1.49-16.redhat_00016.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                "product": {
                  "name": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_id": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-servlet-6.0-api@10.1.49-16.redhat_00016.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                "product": {
                  "name": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_id": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-webapps@10.1.49-16.redhat_00016.1.el8jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                "product": {
                  "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_id": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat@10.1.49-16.redhat_00016.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                "product": {
                  "name": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_id": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-admin-webapps@10.1.49-16.redhat_00016.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                "product": {
                  "name": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_id": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-docs-webapp@10.1.49-16.redhat_00016.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                "product": {
                  "name": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_id": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-el-5.0-api@10.1.49-16.redhat_00016.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                "product": {
                  "name": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_id": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-javadoc@10.1.49-16.redhat_00016.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                "product": {
                  "name": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_id": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-jsp-3.1-api@10.1.49-16.redhat_00016.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                "product": {
                  "name": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_id": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-lib@10.1.49-16.redhat_00016.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                "product": {
                  "name": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_id": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-selinux@10.1.49-16.redhat_00016.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                "product": {
                  "name": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_id": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-servlet-6.0-api@10.1.49-16.redhat_00016.1.el9jws?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                "product": {
                  "name": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_id": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jws6-tomcat-webapps@10.1.49-16.redhat_00016.1.el9jws?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10",
          "product_id": "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch"
        },
        "product_reference": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
        "relates_to_product_reference": "10Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src as a component of Red Hat JBoss Web Server 6.2 on RHEL 10",
          "product_id": "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src"
        },
        "product_reference": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
        "relates_to_product_reference": "10Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10",
          "product_id": "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch"
        },
        "product_reference": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
        "relates_to_product_reference": "10Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10",
          "product_id": "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch"
        },
        "product_reference": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
        "relates_to_product_reference": "10Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10",
          "product_id": "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch"
        },
        "product_reference": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
        "relates_to_product_reference": "10Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10",
          "product_id": "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch"
        },
        "product_reference": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
        "relates_to_product_reference": "10Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10",
          "product_id": "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch"
        },
        "product_reference": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
        "relates_to_product_reference": "10Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10",
          "product_id": "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch"
        },
        "product_reference": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
        "relates_to_product_reference": "10Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10",
          "product_id": "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch"
        },
        "product_reference": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
        "relates_to_product_reference": "10Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10",
          "product_id": "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch"
        },
        "product_reference": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
        "relates_to_product_reference": "10Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 10",
          "product_id": "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch"
        },
        "product_reference": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
        "relates_to_product_reference": "10Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8",
          "product_id": "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch"
        },
        "product_reference": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src as a component of Red Hat JBoss Web Server 6.2 on RHEL 8",
          "product_id": "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src"
        },
        "product_reference": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
        "relates_to_product_reference": "8Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8",
          "product_id": "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch"
        },
        "product_reference": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8",
          "product_id": "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch"
        },
        "product_reference": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8",
          "product_id": "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch"
        },
        "product_reference": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8",
          "product_id": "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch"
        },
        "product_reference": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8",
          "product_id": "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch"
        },
        "product_reference": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8",
          "product_id": "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch"
        },
        "product_reference": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8",
          "product_id": "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch"
        },
        "product_reference": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8",
          "product_id": "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch"
        },
        "product_reference": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 8",
          "product_id": "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch"
        },
        "product_reference": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
        "relates_to_product_reference": "8Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9",
          "product_id": "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        },
        "product_reference": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src as a component of Red Hat JBoss Web Server 6.2 on RHEL 9",
          "product_id": "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src"
        },
        "product_reference": "jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
        "relates_to_product_reference": "9Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9",
          "product_id": "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        },
        "product_reference": "jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9",
          "product_id": "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        },
        "product_reference": "jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9",
          "product_id": "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        },
        "product_reference": "jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9",
          "product_id": "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        },
        "product_reference": "jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9",
          "product_id": "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        },
        "product_reference": "jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9",
          "product_id": "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        },
        "product_reference": "jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9",
          "product_id": "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        },
        "product_reference": "jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9",
          "product_id": "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        },
        "product_reference": "jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch as a component of Red Hat JBoss Web Server 6.2 on RHEL 9",
          "product_id": "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        },
        "product_reference": "jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
        "relates_to_product_reference": "9Base-JWS-6.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-53434",
      "cwe": {
        "id": "CWE-390",
        "name": "Detection of Error Condition Without Action"
      },
      "discovery_date": "2026-06-29T21:01:05.687650+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494668"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists (CRLs) for a FFM (presumably a specific type of connector), the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security controls might not be properly enforced.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Error condition not handled when configuring CRLs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw in Apache Tomcat\u0027s FFM-based connector causes errors loading configured Certificate Revocation Lists (CRLs) to be ignored, which could allow certificates that should be rejected to be accepted. Upstream affected versions are 9.0.83 through 9.0.118, 10.1.0-M7 through 10.1.55, and 11.0.0-M1 through 11.0.22. The affected path requires the FFM connector and CRL-based certificate revocation checking with invalid CRL data.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
          "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
          "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
          "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-53434"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494668",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494668"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-53434",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53434"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53434",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53434"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk",
          "url": "https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk"
        }
      ],
      "release_date": "2026-06-29T20:41:06.948000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T23:03:51+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73981"
        },
        {
          "category": "workaround",
          "details": "This vulnerability only affects Tomcat deployments using the FFM-based connector (requires Java 22+) with CRL-based certificate revocation checking. Deployments using the standard NIO/NIO2 connectors or not using CRL checking are not affected.",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Error condition not handled when configuring CRLs"
    },
    {
      "cve": "CVE-2026-55276",
      "cwe": {
        "id": "CWE-778",
        "name": "Insufficient Logging"
      },
      "discovery_date": "2026-06-29T21:01:38.615799+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494675"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might misinterpret the actual authorization constraints, potentially impacting the security posture of the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Apache Tomcat. When the effective web.xml logging feature is enabled for debugging, special roles and empty authorization constraints may be omitted from the logged output. This is a logging-only issue with no runtime security impact \u2014 it only affects the accuracy of debug log output for administrators reviewing the effective web.xml configuration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
          "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
          "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
          "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55276"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494675",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494675"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55276",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55276"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55276",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55276"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v",
          "url": "https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v"
        }
      ],
      "release_date": "2026-06-29T20:42:23.257000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T23:03:51+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73981"
        },
        {
          "category": "workaround",
          "details": "This is a logging-only issue with no runtime security impact. No mitigation is required. Administrators should not rely solely on the effective web.xml debug log output to verify security constraint configuration.",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow"
    },
    {
      "cve": "CVE-2026-59083",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-07-14T09:01:06.476183+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499917"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding (hex encoding). A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actions that should be restricted.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Low impact vulnerability in Apache Tomcat\u0027s rewrite valve allows a security constraint bypass through improper URL encoding. Exploitation requires specific configurations and has high attack complexity, limiting its overall risk to Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
          "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
          "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
          "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59083"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499917",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499917"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59083",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59083"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59083",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59083"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq",
          "url": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq"
        }
      ],
      "release_date": "2026-07-14T08:13:04.861000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T23:03:51+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73981"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, review Apache Tomcat\u0027s rewrite valve configurations. If the rewrite valve is not essential for your application, consider disabling it. If it is required, ensure its configuration does not permit improper URL encoding that could lead to security constraint bypasses. A service restart may be required for changes to take effect.",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve"
    },
    {
      "cve": "CVE-2026-65182",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-08-25T22:01:20.312934+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524151"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potentially leading to unauthorized access to resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Apache Tomcat allows for security constraint bypasses, potentially granting unauthorized access to protected web application resources. The flaw occurs when security constraints for longer URL paths are defined before more restrictive constraints for shorter, specific sub-paths within the application\u0027s `web.xml` configuration. This misconfiguration can undermine intended access controls in Red Hat deployments of Apache Tomcat.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
          "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
          "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
          "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65182"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524151",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524151"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65182",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65182"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65182",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65182"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m",
          "url": "https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m"
        }
      ],
      "release_date": "2026-08-25T21:43:37.040000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T23:03:51+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73981"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that security constraints in Apache Tomcat\u0027s web.xml configuration files are ordered from most specific to least specific. More restrictive constraints for shorter sub-paths must be defined before broader constraints for longer paths. Incorrect ordering can lead to a bypass of intended access controls. After modifying web.xml, a restart or reload of the Apache Tomcat service is required for the changes to take effect, which may temporarily interrupt service availability.",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control"
    },
    {
      "cve": "CVE-2026-65183",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-08-25T22:01:35.987506+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524153"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. A Time-of-check Time-of-use (TOCTOU) race condition exists when creating Unix domain sockets. This vulnerability allows an unauthorized local user to exploit the timing window to gain access to the Unix domain socket. This could lead to information disclosure or other unauthorized operations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in Apache Tomcat is rated Low. It involves a Time-of-check Time-of-use (TOCTOU) race condition when creating Unix domain sockets, which could allow a local attacker to gain unauthorized access to the socket. Exploitation requires local access and a specific timing window, limiting its impact to information disclosure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
          "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
          "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
          "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65183"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524153",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524153"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65183",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65183"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65183",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65183"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/748o4st6d5dk6n3l7tgzo5yl68gg05c0",
          "url": "https://lists.apache.org/thread/748o4st6d5dk6n3l7tgzo5yl68gg05c0"
        }
      ],
      "release_date": "2026-08-25T21:44:49.363000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T23:03:51+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73981"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition"
    },
    {
      "cve": "CVE-2026-65905",
      "cwe": {
        "id": "CWE-294",
        "name": "Authentication Bypass by Capture-replay"
      },
      "discovery_date": "2026-08-25T22:02:01.496501+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524161"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This allows the attacker to replay the request once, potentially bypassing authentication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Apache Tomcat\u0027s DIGEST authenticator allows a limited authentication bypass through a replay attack. While the attack complexity is high, a remote attacker could potentially replay a single authenticated request if the nonceCount is at the upper boundary of the replay window, leading to limited unauthorized access. This vulnerability affects configurations utilizing DIGEST authentication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
          "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
          "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
          "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65905"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524161",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524161"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65905",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65905"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65905",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65905"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj",
          "url": "https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj"
        }
      ],
      "release_date": "2026-08-25T21:51:33.307000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T23:03:51+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73981"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable DIGEST authentication in Apache Tomcat if it is not a required authentication mechanism for your deployment. Refer to the Apache Tomcat documentation for guidance on configuring authentication methods. Disabling DIGEST authentication will affect services that depend on it. A restart of the Tomcat service is necessary for the configuration changes to be applied.",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator"
    },
    {
      "cve": "CVE-2026-65927",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "discovery_date": "2026-08-25T22:01:39.117949+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve\u0027s [N] flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Apache Tomcat due to an off-by-one error in the RewriteValve\u0027s [N] flag processing. This vulnerability can lead to an access control bypass, allowing unauthorized access to resources in applications that utilize the RewriteValve with the [N] flag.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
          "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
          "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
          "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65927"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65927",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65927"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65927",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65927"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4",
          "url": "https://lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4"
        }
      ],
      "release_date": "2026-08-25T21:53:05.852000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T23:03:51+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73981"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing"
    },
    {
      "cve": "CVE-2026-66299",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-28T17:29:36.546307+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508085"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This uncontrolled resource consumption vulnerability, located in the WebSocket chat example, allows a remote attacker to cause a Denial of Service (DoS) by exhausting system resources. This can lead to the affected system becoming unresponsive or crashing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Denial of Service via WebSocket chat example",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate severity flaw in Apache Tomcat\u0027s WebSocket chat example could lead to a denial of service. The impact is limited as the vulnerable component is part of an example application, which is generally not deployed in production environments. Exploitation requires the example application to be present and accessible.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
          "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
          "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
          "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-66299"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508085",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508085"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-66299",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-66299"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66299",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66299"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/8owczcc1o8qw1rxmg9gvfk4w2jnh4l5k",
          "url": "https://lists.apache.org/thread/8owczcc1o8qw1rxmg9gvfk4w2jnh4l5k"
        }
      ],
      "release_date": "2026-07-28T14:29:05.810000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T23:03:51+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73981"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, remove the `examples` web application from your Apache Tomcat installation. This can typically be achieved by deleting the `examples` directory or `examples.war` file from the `webapps` directory of your Tomcat installation. A restart of the Tomcat service may be required for the changes to take full effect.",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: Denial of Service via WebSocket chat example"
    },
    {
      "cve": "CVE-2026-66422",
      "cwe": {
        "id": "CWE-386",
        "name": "Symbolic Name not Mapping to Correct Object"
      },
      "discovery_date": "2026-08-25T22:01:44.899132+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524156"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole(). This misconfiguration allows for a bypass of declarative role constraints, which could lead to unauthorized access to resources that should be restricted based on user roles.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Low impact. It requires high privileges to exploit and only affects the confidentiality of information by allowing a bypass of declarative role constraints. In Red Hat deployments, where Apache Tomcat instances are typically configured with strict access controls, this flaw primarily impacts already highly privileged users, limiting its overall risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
          "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
          "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
          "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-66422"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524156",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524156"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-66422",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-66422"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66422",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66422"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/j5plylz1b2vhqvbkqn7k58nygxhcpk73",
          "url": "https://lists.apache.org/thread/j5plylz1b2vhqvbkqn7k58nygxhcpk73"
        }
      ],
      "release_date": "2026-08-25T21:55:16.928000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T23:03:51+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73981"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints"
    },
    {
      "cve": "CVE-2026-68525",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-08-25T22:02:06.162838+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524162"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be restricted to POST requests only.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact vulnerability in Apache Tomcat\u0027s FORM authentication process, as utilized in Red Hat JBoss Web Server, allows an attacker to bypass security constraints for POST requests. This enables unauthorized access to resources that are configured to restrict POST access while permitting GET, potentially leading to unintended data exposure or manipulation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
          "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
          "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
          "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68525"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524162",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524162"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68525",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68525"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68525",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68525"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7",
          "url": "https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7"
        }
      ],
      "release_date": "2026-08-25T21:57:18.557000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T23:03:51+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73981"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass"
    },
    {
      "cve": "CVE-2026-68569",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "discovery_date": "2026-08-25T22:01:58.059796+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized access to the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Apache Tomcat allows unauthorized access when configured with CLIENT-CERT or SPNEGO authentication alongside a DataSourceRealm. This flaw could permit a user to be authenticated even if their account does not exist, bypassing intended security controls in Red Hat deployments where these specific configurations are in use.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
          "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
          "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
          "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68569"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68569",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68569"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68569",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68569"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc",
          "url": "https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc"
        }
      ],
      "release_date": "2026-08-25T21:59:17.438000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T23:03:51+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73981"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid using CLIENT-CERT or SPNEGO authentication methods with the DataSourceRealm in Apache Tomcat. Alternatively, restrict network access to the Apache Tomcat instance to trusted clients only, thereby limiting exposure to potential attackers. If changes are made to the Tomcat configuration, a service restart may be required for the changes to take effect.",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure"
    },
    {
      "cve": "CVE-2026-68763",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-25T22:10:59.055803+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524166"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service (DoS), making the server unresponsive or unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Apache Tomcat, as shipped with Red Hat JBoss Web Server, allows a remote, unauthenticated attacker to cause a denial of service. The vulnerability stems from an allocation leak in the HTTP/2 backlog tracking, which can be triggered by resetting an HTTP/2 stream, leading to resource exhaustion and service unavailability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
          "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
          "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
          "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68763"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524166",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524166"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68763",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68763"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68763",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68763"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/tv51ty39ppv41v04hdtkp9dp7tg02nzl",
          "url": "https://lists.apache.org/thread/tv51ty39ppv41v04hdtkp9dp7tg02nzl"
        }
      ],
      "release_date": "2026-08-25T22:00:37.047000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T23:03:51+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73981"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, disable the HTTP/2 protocol in Apache Tomcat if it is not required for your deployment. This can be achieved by commenting out or removing the \u003cUpgradeProtocol className=\"org.apache.coyote.http2.Http2Protocol\" /\u003e element within the \u003cConnector\u003e configuration in the server.xml file. After modifying server.xml, a restart of the Apache Tomcat service is required for the changes to take effect.",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak"
    },
    {
      "cve": "CVE-2026-73180",
      "cwe": {
        "id": "CWE-613",
        "name": "Insufficient Session Expiration"
      },
      "discovery_date": "2026-08-25T22:10:56.242601+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524165"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session\u0027s ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when the associated HTTP session ends. This could allow an attacker to maintain an active WebSocket session, potentially leading to unauthorized access or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Apache Tomcat allows an authenticated WebSocket session to persist even after its associated HTTP session has terminated, provided the HTTP session ID was changed after WebSocket establishment. This could lead to unauthorized access or information disclosure in Red Hat environments where Apache Tomcat applications utilize WebSockets with dynamic session ID management, extending access beyond the intended HTTP session lifetime.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
          "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
          "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
          "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
          "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73180"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524165",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524165"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73180",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73180"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73180",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73180"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/3j15vztszpyqss253mjq5v1kp7s6hooq",
          "url": "https://lists.apache.org/thread/3j15vztszpyqss253mjq5v1kp7s6hooq"
        }
      ],
      "release_date": "2026-08-25T22:01:58+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T23:03:51+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:73981"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el10jws.src",
            "10Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "10Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el10jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el8jws.src",
            "8Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "8Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el8jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-0:10.1.49-16.redhat_00016.1.el9jws.src",
            "9Base-JWS-6.2:jws6-tomcat-admin-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-docs-webapp-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-el-5.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-javadoc-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-jsp-3.1-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-lib-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-selinux-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-servlet-6.0-api-0:10.1.49-16.redhat_00016.1.el9jws.noarch",
            "9Base-JWS-6.2:jws6-tomcat-webapps-0:10.1.49-16.redhat_00016.1.el9jws.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.