Read the docs
Red Hat Security Advisory

RHSA-2026:18536

tomcat9 security update

Released 2026-05-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 7 records

TI-2024-25564 CVE-2024-38286 · GHSA-7jqf-v358-p8g7

Apache Tomcat: Denial of Service

Priority MEDIUM 47

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0169 Published 2024-11-07 Partial fix · 11.0.0-M21, 10.1.25 +1 CWE-770
TI-2024-23041 CVE-2024-34750 · GHSA-wm9w-rjj3-j356

Apache Tomcat: HTTP/2 excess header handling DoS

Priority MEDIUM 46

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04602 Published 2024-07-03 Partial fix · 11.0.0-M21, 10.1.25 +1 CWE-400
TI-2026-40363 CVE-2026-55957 · GHSA-7895-gffq-w6jq

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

Priority MEDIUM 45

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.02855 Published 2026-06-29 Partial fix · 11.0.5, 10.1.37 +1 CWE-304
TI-2025-29372 CVE-2025-46701 · GHSA-h2fw-rfh5-95r3

Apache Tomcat: Security constraint bypass for CGI scripts

Priority MEDIUM 44

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.03143 Published 2025-05-29 Partial fix · 9.0.105, 10.1.41 +1 CWE-178
TI-2025-35099 CVE-2025-55668 · GHSA-23hv-mwm6-g8jf

Apache Tomcat: session fixation via rewrite valve

Priority LOW 31

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00945 Published 2025-08-13 Partial fix · 11.0.8, 10.1.42 +1 CWE-384