TI-2026-31686 CVE-2026-43512 · GHSA-h6fc-48rj-7qqh
Apache Tomcat: Digest authenticator will authenticate any unknown user
Priority MEDIUM 52
DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.
RHSA-2026:43401
Red Hat JBoss Web Server 6.2.4 release and security update
Released 2026-07-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Web Server 6.2 on RHEL 10 jws6-tomcat-10.1.49-15.redhat_00013.1.el10jws, jws6-tomcat-admin-webapps-10.1.49-15.redhat_00013.1.el10jws, jws6-tomcat-docs-webapp-10.1.49-15.redhat_00013.1.el10jws +7
- Red Hat JBoss Web Server 6.2 on RHEL 8 jws6-tomcat-10.1.49-15.redhat_00013.1.el8jws, jws6-tomcat-admin-webapps-10.1.49-15.redhat_00013.1.el8jws, jws6-tomcat-docs-webapp-10.1.49-15.redhat_00013.1.el8jws +7
- Red Hat JBoss Web Server 6.2 on RHEL 9 jws6-tomcat-10.1.49-15.redhat_00013.1.el9jws, jws6-tomcat-admin-webapps-10.1.49-15.redhat_00013.1.el9jws, jws6-tomcat-docs-webapp-10.1.49-15.redhat_00013.1.el9jws +7
Fixes 9 records
TI-2026-29896 CVE-2026-41293 · GHSA-r29c-68gh-xp6x
Apache Tomcat: HTTP/2 request headers not validated
Priority MEDIUM 52
Improper Input Validation vulnerability in Apache Tomcat.
TI-2026-31689 CVE-2026-43515 · GHSA-5m62-pw8w-7w9f
Apache Tomcat: Security constraints not correctly applied
Priority MEDIUM 50
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.
TI-2026-29890 CVE-2026-41284 · GHSA-gx5v-xp9w-j4cg
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
Priority MEDIUM 40
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
TI-2026-38490 CVE-2026-53404 · GHSA-h792-v28v-ppgr
Apache Tomcat: Bad ornext processing in RewriteValve
Priority LOW 39
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.
TI-2026-31687 CVE-2026-43513 · GHSA-5mp6-jrq3-r938
Apache Tomcat: LockOutRealm treats user names as case-sensitive
Priority LOW 39
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.
TI-2026-30781 CVE-2026-42498 · GHSA-fv25-8xcx-gqjc
Apache Tomcat: WebSocket authentication header exposure
Priority LOW 39
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.
TI-2026-40362 CVE-2026-55956 · GHSA-5v3h-fjv2-54fg
Apache Tomcat: Security constraints for default servlet ignored method
Priority LOW 36
Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.
TI-2026-31688 CVE-2026-43514 · GHSA-9m89-8frq-c98c
Apache Tomcat: AJP secret compared in non-constant time
Priority LOW 18
Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.