TI-2026-31686 CVE-2026-43512 · GHSA-h6fc-48rj-7qqh
Apache Tomcat: Digest authenticator will authenticate any unknown user
Priority MEDIUM 52
DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.
RHSA-2026:67164
tomcat security update
Released 2026-09-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) tomcat-1:10.1.49-1.el10_0, tomcat-admin-webapps-1:10.1.49-1.el10_0, tomcat-docs-webapp-1:10.1.49-1.el10_0 +5
Fixes 7 records
TI-2026-29896 CVE-2026-41293 · GHSA-r29c-68gh-xp6x
Apache Tomcat: HTTP/2 request headers not validated
Priority MEDIUM 52
Improper Input Validation vulnerability in Apache Tomcat.
TI-2026-31689 CVE-2026-43515 · GHSA-5m62-pw8w-7w9f
Apache Tomcat: Security constraints not correctly applied
Priority MEDIUM 50
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.
TI-2026-40363 CVE-2026-55957 · GHSA-7895-gffq-w6jq
Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
Priority MEDIUM 45
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.
TI-2026-31687 CVE-2026-43513 · GHSA-5mp6-jrq3-r938
Apache Tomcat: LockOutRealm treats user names as case-sensitive
Priority LOW 39
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.
TI-2026-30781 CVE-2026-42498 · GHSA-fv25-8xcx-gqjc
Apache Tomcat: WebSocket authentication header exposure
Priority LOW 39
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.
TI-2026-25438 CVE-2026-32990 · GHSA-8mc5-53m5-3qj2
Apache Tomcat: Fix for CVE-2025-66614 is incomplete
Priority LOW 30
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.