Read the docs
Red Hat Security Advisory

RHSA-2026:68651

tomcat9 security update

Released 2026-09-18 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 16 records

TI-2026-29896 CVE-2026-41293 · GHSA-r29c-68gh-xp6x

Apache Tomcat: HTTP/2 request headers not validated

Priority MEDIUM 52

Improper Input Validation vulnerability in Apache Tomcat.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01705 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-20
TI-2026-31689 CVE-2026-43515 · GHSA-5m62-pw8w-7w9f

Apache Tomcat: Security constraints not correctly applied

Priority MEDIUM 50

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01221 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-285
TI-2026-42264 CVE-2026-59084 · GHSA-cwxf-7cw2-7r32

Apache Tomcat: EncryptInterceptor requirements not clearly documented

Priority MEDIUM 48

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00506 Published 2026-07-14 Partial fix CWE-1059
TI-2026-39931 CVE-2026-55276 · GHSA-mqg3-r7h5-24x4

Apache Tomcat: Logged effective web.xml is incomplete

Priority MEDIUM 48

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00607 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-670
TI-2026-38490 CVE-2026-53404 · GHSA-h792-v28v-ppgr

Apache Tomcat: Bad ornext processing in RewriteValve

Priority LOW 39

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00699 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-670
TI-2026-30781 CVE-2026-42498 · GHSA-fv25-8xcx-gqjc

Apache Tomcat: WebSocket authentication header exposure

Priority LOW 39

Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00691 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-200
TI-2026-40362 CVE-2026-55956 · GHSA-5v3h-fjv2-54fg

Apache Tomcat: Security constraints for default servlet ignored method

Priority LOW 36

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00695 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-285
TI-2026-36982 CVE-2026-50229 · GHSA-pg42-rg8c-j886

Apache Tomcat: XSS in number guess example

Priority LOW 34

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04091 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-80
TI-2026-25438 CVE-2026-32990 · GHSA-8mc5-53m5-3qj2

Apache Tomcat: Fix for CVE-2025-66614 is incomplete

Priority LOW 30

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00313 Published 2026-04-09 Partial fix · 9.0.116, 10.1.53 +1 CWE-20
TI-2026-40361 CVE-2026-55955 · GHSA-c5ph-rghf-fjfj

Apache Tomcat: EncryptInterceptor not protected against replay attacks

Priority LOW 29

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00436 Published 2026-06-29 Partial fix · 11.0.23, 10.1.56 +1 CWE-287
TI-2026-31688 CVE-2026-43514 · GHSA-9m89-8frq-c98c

Apache Tomcat: AJP secret compared in non-constant time

Priority LOW 18

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00352 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-208