Red Hat Security Advisory

RHSA-2026:25341

tomcat9 security update

Released 2026-06-11 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) tomcat9-1:9.0.117-1.el10_2, tomcat9-admin-webapps-1:9.0.117-1.el10_2, tomcat9-docs-webapp-1:9.0.117-1.el10_2 +5

Fixes 9 records

TI-2026-23283 CVE-2026-29145 · GHSA-95jq-rwvf-vjx4

Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

MEDIUM 46

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00727 Published 2026-04-09 Partial fix · 9.0.116, 10.1.53 +1 CWE-287

TI-2026-20066 CVE-2026-24880 · GHSA-563x-q5rq-57qp

Apache Tomcat: Request smuggling via invalid chunk extension

MEDIUM 40

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00709 Published 2026-04-09 Partial fix · 9.0.116, 10.1.52 +1 CWE-444

TI-2026-26742 CVE-2026-34487 · GHSA-x4m4-345f-5h5g

Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

LOW 39

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00455 Published 2026-04-09 Partial fix · 9.0.117, 10.1.54 +1 CWE-532

TI-2026-26740 CVE-2026-34483 · GHSA-rv64-5gf8-9qq8

Apache Tomcat: Incomplete escaping of JSON access logs

LOW 39

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00469 Published 2026-04-09 Partial fix · 9.0.116, 10.1.54 +1 CWE-116

TI-2025-41013 CVE-2025-66614 · GHSA-fpj8-gq4v-p354

Apache Tomcat: Client certificate verification bypass due to virtual host mapping

LOW 39

Improper Input Validation vulnerability.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00274 Published 2026-02-17 Partial fix · 11.0.15, 10.1.50 +1 CWE-20

TI-2026-19939 CVE-2026-24734 · GHSA-mgp5-rv84-w37q

Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

LOW 34

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00575 Published 2026-02-17 Partial fix · 11.0.18, 10.1.52 +1 CWE-20

TI-2026-19938 CVE-2026-24733 · GHSA-qq5r-98hh-rxc9

Apache Tomcat: Security constraint bypass with HTTP/0.9

LOW 30

Improper Input Validation vulnerability in Apache Tomcat.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00552 Published 2026-02-17 Partial fix · 11.0.15, 10.1.50 +1 CWE-20

TI-2026-26752 CVE-2026-34500 · GHSA-24j9-x2wg-9qv6

Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

LOW 29

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00458 Published 2026-04-09 Partial fix · 9.0.117, 10.1.54 +1 CWE-287

TI-2026-20898 CVE-2026-25854 · GHSA-9m3c-qcxr-9x87

Apache Tomcat: Occasionally open redirect

LOW 28

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00582 Published 2026-04-09 Partial fix · 9.0.116, 10.1.53 +1 CWE-601