Red Hat Security Advisory

RHSA-2026:68258

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-09-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images tomcat11-1:11.0.26-0.1.hum1@noarch@public-hummingbird-aarch64-rpms, tomcat11-1:11.0.26-0.1.hum1@noarch@public-hummingbird-x86_64-rpms, tomcat11-1:11.0.26-0.1.hum1@src +18

Fixes 14 records

TI-2026-53292 CVE-2026-76183 · GHSA-q4fc-3vv4-fh24

Apache Tomcat: Bypass of security constraints for WebSocket endpoints

MEDIUM 50

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00566 Published 2026-09-23 Partial fix CWE-289

TI-2026-59035 CVE-2026-86248 · GHSA-c47j-g3rg-hrfq

Improper authentication in Apache Tomcat

MEDIUM 49

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00496 Published 2026-09-23 Partial fix CWE-287

TI-2026-59116 CVE-2026-86350 · GHSA-6ff5-mwrj-376m

Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

MEDIUM 48

Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00483 Published 2026-09-23 Partial fix CWE-444

TI-2026-59440 CVE-2026-87022 · GHSA-xwrc-v28h-528j

Apache Tomcat: WebSocket message smuggling with per-message-deflate

MEDIUM 40

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0054 Published 2026-09-23 Partial fix CWE-130

TI-2026-54180 CVE-2026-77791 · GHSA-9cg7-2q68-g3mq

Apache Tomcat: DoS via busy wait during WebSocket close

MEDIUM 40

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00679 Published 2026-09-23 Partial fix CWE-400

TI-2026-29890 CVE-2026-41284 · GHSA-gx5v-xp9w-j4cg

Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

MEDIUM 40

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00839 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-770

TI-2026-55175 CVE-2026-79677 · GHSA-r5gx-4gq8-822g

Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout

LOW 39

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00422 Published 2026-09-23 Partial fix CWE-1025

TI-2026-54537 CVE-2026-78437 · GHSA-hvg5-8g86-xm44

Apache Tomcat: HTTP/2 DoS via malformed request

LOW 39

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00511 Published 2026-09-23 Partial fix CWE-459

TI-2026-54513 CVE-2026-78383 · GHSA-rpxf-vjhq-9cv9

Apache Tomcat: AJP DoS via missing request body

LOW 39

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.005 Published 2026-09-23 Partial fix CWE-770

TI-2026-53187 CVE-2026-75973 · GHSA-q9fp-9gfr-vj9g

Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured

LOW 39

Improper Authentication vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00518 Published 2026-09-23 Partial fix CWE-287

TI-2026-54155 CVE-2026-77762 · GHSA-28v4-2v86-58cc

Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request

LOW 38

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00464 Published 2026-09-23 Partial fix CWE-362

TI-2026-48316 CVE-2026-68569 · GHSA-5q6q-ffrq-6xfc

Apache Tomcat: Principal lookup can fail open in some cases

LOW 38

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0046 Published 2026-08-25 Partial fix CWE-287

TI-2026-51668 CVE-2026-73581 · GHSA-cf68-55f3-8gfw

Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore

LOW 34

Improper Check for Certificate Revocation vulnerability in Apache Tomcat.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00159 Published 2026-09-23 Partial fix CWE-299

TI-2026-54150 CVE-2026-77756 · GHSA-gpfr-7w77-mp48

Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests

LOW 18

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00526 Published 2026-09-23 Partial fix CWE-444