Red Hat Security Advisory

RHSA-2026:13745

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-05-05 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images tomcat11-11.0.22-0.1.hum1@noarch@public-hummingbird-aarch64-rpms, tomcat11-11.0.22-0.1.hum1@noarch@public-hummingbird-x86_64-rpms, tomcat11-11.0.22-0.1.hum1@src +18

TI-2026-31686 CVE-2026-43512 · GHSA-h6fc-48rj-7qqh

MEDIUM 52

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01326 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-592

TI-2026-31689 CVE-2026-43515 · GHSA-5m62-pw8w-7w9f

MEDIUM 50

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01221 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-285

TI-2026-30781 CVE-2026-42498 · GHSA-fv25-8xcx-gqjc

LOW 39

Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00691 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-200

TI-2026-31688 CVE-2026-43514 · GHSA-9m89-8frq-c98c

LOW 18

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00352 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-208