Red Hat Security Advisory

RHSA-2026:37767

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-07-10 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat Hardened Images tomcat10-1:10.1.57-1.hum1@noarch@public-hummingbird-aarch64-rpms, tomcat10-1:10.1.57-1.hum1@noarch@public-hummingbird-x86_64-rpms, tomcat10-1:10.1.57-1.hum1@src +18

Fixes 2 records

TI-2026-42264 CVE-2026-59084 · GHSA-cwxf-7cw2-7r32

Apache Tomcat: EncryptInterceptor requirements not clearly documented

MEDIUM 48

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00506 Published 2026-07-14 Partial fix CWE-1059

TI-2026-42263 CVE-2026-59083 · GHSA-hcjr-322h-429r

Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

MEDIUM 48

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00522 Published 2026-07-14 Partial fix CWE-177