RHSA-2026:67163
Vulnerability from csaf_redhat - Published: 2026-09-14 05:05 - Updated: 2026-09-14 11:46Summary
Red Hat Security Advisory: tomcat9 security update
Severity
Important
Notes
Topic: An update for tomcat9 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.
Security Fix(es):
* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)
* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
* tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)
* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue (CVE-2025-66614). This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application.
7.3 (High)
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid.
7.3 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks.
5.3 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application.
5.4 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct password, leading to unauthorized access.
7.3 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Important
A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding (hex encoding). A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actions that should be restricted.
CWE-807 - Reliance on Untrusted Inputs in a Security DecisionAffected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Low
A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance, potentially compromising the confidentiality or integrity of data processed by the affected system.
CWE-1188 - Initialization of a Resource with an Insecure DefaultAffected products
Fixed
9 products, the same list as for
CVE-2026-32990
Threats
Impact
Low
References
57 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for tomcat9 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.\n\nSecurity Fix(es):\n\n* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n\n* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n\n* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n\n* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n\n* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n\n* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n\n* tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)\n\n* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n\n* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:67163",
"url": "https://access.redhat.com/errata/RHSA-2026:67163"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2457025",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457025"
},
{
"category": "external",
"summary": "2476511",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476511"
},
{
"category": "external",
"summary": "2476513",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476513"
},
{
"category": "external",
"summary": "2476516",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476516"
},
{
"category": "external",
"summary": "2476519",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476519"
},
{
"category": "external",
"summary": "2476520",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476520"
},
{
"category": "external",
"summary": "2494669",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494669"
},
{
"category": "external",
"summary": "2499917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499917"
},
{
"category": "external",
"summary": "2499931",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499931"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67163.json"
}
],
"title": "Red Hat Security Advisory: tomcat9 security update",
"tracking": {
"current_release_date": "2026-09-14T11:46:35+00:00",
"generator": {
"date": "2026-09-14T11:46:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.21"
}
},
"id": "RHSA-2026:67163",
"initial_release_date": "2026-09-14T05:05:53+00:00",
"revision_history": [
{
"date": "2026-09-14T05:05:53+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-14T05:05:53+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-14T11:46:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat9-1:9.0.120-1.el10_0.noarch",
"product": {
"name": "tomcat9-1:9.0.120-1.el10_0.noarch",
"product_id": "tomcat9-1:9.0.120-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9@9.0.120-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"product": {
"name": "tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"product_id": "tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-admin-webapps@9.0.120-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"product": {
"name": "tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"product_id": "tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-docs-webapp@9.0.120-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"product": {
"name": "tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"product_id": "tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-el-3.0-api@9.0.120-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"product": {
"name": "tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"product_id": "tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-jsp-2.3-api@9.0.120-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"product": {
"name": "tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"product_id": "tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-lib@9.0.120-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"product": {
"name": "tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"product_id": "tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-servlet-4.0-api@9.0.120-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat9-webapps-1:9.0.120-1.el10_0.noarch",
"product": {
"name": "tomcat9-webapps-1:9.0.120-1.el10_0.noarch",
"product_id": "tomcat9-webapps-1:9.0.120-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9-webapps@9.0.120-1.el10_0?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat9-1:9.0.120-1.el10_0.src",
"product": {
"name": "tomcat9-1:9.0.120-1.el10_0.src",
"product_id": "tomcat9-1:9.0.120-1.el10_0.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat9@9.0.120-1.el10_0?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-1:9.0.120-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch"
},
"product_reference": "tomcat9-1:9.0.120-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-1:9.0.120-1.el10_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src"
},
"product_reference": "tomcat9-1:9.0.120-1.el10_0.src",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch"
},
"product_reference": "tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch"
},
"product_reference": "tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch"
},
"product_reference": "tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch"
},
"product_reference": "tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-lib-1:9.0.120-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch"
},
"product_reference": "tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch"
},
"product_reference": "tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat9-webapps-1:9.0.120-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
"product_id": "AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
},
"product_reference": "tomcat9-webapps-1:9.0.120-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z.E2S"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32990",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2026-04-09T20:01:19.299996+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457025"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue (CVE-2025-66614). This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact. This improper input validation vulnerability in Apache Tomcat, stemming from an incomplete fix for CVE-2025-66614, affects Red Hat JBoss Web Server and Red Hat Enterprise Linux. An attacker could exploit this flaw to bypass security controls or induce unexpected application behavior.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32990"
},
{
"category": "external",
"summary": "RHBZ#2457025",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457025"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32990"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32990",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32990"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7",
"url": "https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7"
}
],
"release_date": "2026-04-09T19:23:49.618000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T05:05:53+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67163"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix"
},
{
"cve": "CVE-2026-41293",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-05-12T16:01:31.003990+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476513"
}
],
"notes": [
{
"category": "description",
"text": "Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41293"
},
{
"category": "external",
"summary": "RHBZ#2476513",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476513"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41293",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41293"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41293",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41293"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r",
"url": "https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r"
}
],
"release_date": "2026-05-12T15:19:35.179000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T05:05:53+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67163"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated"
},
{
"cve": "CVE-2026-42498",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-05-12T16:01:38.872167+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476516"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42498"
},
{
"category": "external",
"summary": "RHBZ#2476516",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476516"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42498",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42498"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42498",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42498"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb",
"url": "https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb"
}
],
"release_date": "2026-05-12T15:17:56.531000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T05:05:53+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67163"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication."
},
{
"cve": "CVE-2026-43512",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-05-12T16:01:26.008892+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476511"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password \"null\". This allows a remote attacker to bypass security controls.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Apache Tomcat allows an authentication bypass when DIGEST authentication is configured. An attacker can authenticate as any unknown user by providing the password \u0027null\u0027, potentially gaining unauthorized access to applications protected by DIGEST authentication. Red Hat products are only affected if they are configured to use DIGEST authentication, which is not a common, out of the box and expected configuration for Production environments. \n\nFurthermore, because the unknown user is not mapped to any valid realm roles, their access is still restricted by standard application authorization constraints, significantly limiting the actual impact.\n\nThe unknown user is not mapped to any existing user, which means, it does not steal credentials nor impersonate an existing user. This new user is expected to have the minimum possible authentication and authorization range within the realm inherited roles.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43512"
},
{
"category": "external",
"summary": "RHBZ#2476511",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476511"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43512"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73",
"url": "https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73"
}
],
"release_date": "2026-05-12T15:24:02.424000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T05:05:53+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67163"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable DIGEST authentication within Apache Tomcat if it is not essential for your environment. This involves modifying the server\u0027s authentication configuration to utilize alternative methods or remove the DIGEST realm. A service restart is required for these changes to take effect and may impact functionality relying on DIGEST authentication.",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication"
},
{
"cve": "CVE-2026-43513",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-05-12T16:01:48.767743+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476520"
}
],
"notes": [
{
"category": "description",
"text": "In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache Tomcat\u0027s LockOutRealm. When configured with an underlying Realm where usernames are case-insensitive, the LockOutRealm does not account for case differences, potentially reducing the effectiveness of brute-force protection. Exploitation requires LockOutRealm to be configured with a case-insensitive authentication backend, which is a non-default configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43513"
},
{
"category": "external",
"summary": "RHBZ#2476520",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476520"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43513"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp",
"url": "https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp"
}
],
"release_date": "2026-05-12T15:26:25.599000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T05:05:53+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67163"
},
{
"category": "workaround",
"details": "This vulnerability only affects Tomcat deployments using the LockOutRealm with a case-insensitive authentication backend. Deployments not using LockOutRealm or using case-sensitive authentication backends are not affected.",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm"
},
{
"cve": "CVE-2026-43515",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-05-12T16:01:46.217175+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476519"
}
],
"notes": [
{
"category": "description",
"text": "In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-coyote: tomcat: Improper Authorization allows security bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43515"
},
{
"category": "external",
"summary": "RHBZ#2476519",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476519"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43515"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb",
"url": "https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb"
}
],
"release_date": "2026-05-12T15:33:23.311000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T05:05:53+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67163"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass"
},
{
"cve": "CVE-2026-55957",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2026-06-29T21:01:13.605887+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494669"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct password, leading to unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated as Important severity because it allows an attacker to fully bypass password verification when authenticating against a Tomcat instance, potentially gaining unauthorized access to protected resources without any privileges or user interaction required.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55957"
},
{
"category": "external",
"summary": "RHBZ#2494669",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494669"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55957",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55957"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55957",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55957"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh",
"url": "https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh"
}
],
"release_date": "2026-06-29T20:47:12.661000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T05:05:53+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67163"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration"
},
{
"cve": "CVE-2026-59083",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-07-14T09:01:06.476183+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499917"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding (hex encoding). A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actions that should be restricted.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Low impact vulnerability in Apache Tomcat\u0027s rewrite valve allows a security constraint bypass through improper URL encoding. Exploitation requires specific configurations and has high attack complexity, limiting its overall risk to Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59083"
},
{
"category": "external",
"summary": "RHBZ#2499917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499917"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59083",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59083"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59083",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59083"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq",
"url": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq"
}
],
"release_date": "2026-07-14T08:13:04.861000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T05:05:53+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67163"
},
{
"category": "workaround",
"details": "To mitigate this issue, review Apache Tomcat\u0027s rewrite valve configurations. If the rewrite valve is not essential for your application, consider disabling it. If it is required, ensure its configuration does not permit improper URL encoding that could lead to security constraint bypasses. A service restart may be required for changes to take effect.",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve"
},
{
"cve": "CVE-2026-59084",
"cwe": {
"id": "CWE-1188",
"name": "Initialization of a Resource with an Insecure Default"
},
"discovery_date": "2026-07-14T10:01:17.476740+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499931"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance, potentially compromising the confidentiality or integrity of data processed by the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Low impact vulnerability in Apache Tomcat arises from insufficient documentation for the EncryptInterceptor. Without clear guidance on secure configuration, administrators might inadvertently deploy the interceptor in a way that weakens security, rather than a direct code flaw. This issue affects Red Hat products utilizing Apache Tomcat, including Red Hat Enterprise Linux and Red Hat JBoss Web Server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59084"
},
{
"category": "external",
"summary": "RHBZ#2499931",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499931"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59084",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59084"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59084",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59084"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7",
"url": "https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7"
}
],
"release_date": "2026-07-14T08:24:21.531000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T05:05:53+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67163"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that the EncryptInterceptor in Apache Tomcat is configured according to secure best practices. Review existing configurations of EncryptInterceptor to verify that all security requirements are met and that no insecure settings are in place. If the EncryptInterceptor is not actively used, no specific action is required.",
"product_ids": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.8,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-1:9.0.120-1.el10_0.src",
"AppStream-10.0.Z.E2S:tomcat9-admin-webapps-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-docs-webapp-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-el-3.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-jsp-2.3-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-lib-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-servlet-4.0-api-1:9.0.120-1.el10_0.noarch",
"AppStream-10.0.Z.E2S:tomcat9-webapps-1:9.0.120-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…