Red Hat Security Advisory

RHSA-2026:32960

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-06-29 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Hardened Images tomcat11-1:11.0.23-0.1.hum1@noarch@public-hummingbird-aarch64-rpms, tomcat11-1:11.0.23-0.1.hum1@noarch@public-hummingbird-x86_64-rpms, tomcat11-1:11.0.23-0.1.hum1@src +18

Fixes 7 records

TI-2026-39931 CVE-2026-55276 · GHSA-mqg3-r7h5-24x4

Apache Tomcat: Logged effective web.xml is incomplete

MEDIUM 48

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00607 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-670

TI-2026-38516 CVE-2026-53434 · GHSA-4x29-79gh-6v8q

Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

MEDIUM 48

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00586 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-390

TI-2026-40363 CVE-2026-55957 · GHSA-7895-gffq-w6jq

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

MEDIUM 45

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.02855 Published 2026-06-29 Partial fix · 11.0.5, 10.1.37 +1 CWE-304

TI-2026-38490 CVE-2026-53404 · GHSA-h792-v28v-ppgr

Apache Tomcat: Bad ornext processing in RewriteValve

LOW 39

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00699 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-670

TI-2026-40362 CVE-2026-55956 · GHSA-5v3h-fjv2-54fg

Apache Tomcat: Security constraints for default servlet ignored method

LOW 36

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00695 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-285

TI-2026-36982 CVE-2026-50229 · GHSA-pg42-rg8c-j886

Apache Tomcat: XSS in number guess example

LOW 34

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04091 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-80

TI-2026-40361 CVE-2026-55955 · GHSA-c5ph-rghf-fjfj

Apache Tomcat: EncryptInterceptor not protected against replay attacks

LOW 29

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00436 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-287