Red Hat Security Advisory

RHSA-2026:69259

tomcat update

Released 2026-09-21 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) tomcat-1:10.1.49-4.el10_2, tomcat-admin-webapps-1:10.1.49-4.el10_2, tomcat-docs-webapp-1:10.1.49-4.el10_2 +5

TI-2026-31686 CVE-2026-43512 · GHSA-h6fc-48rj-7qqh

MEDIUM 52

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01326 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-592

TI-2026-29896 CVE-2026-41293 · GHSA-r29c-68gh-xp6x

MEDIUM 52

Improper Input Validation vulnerability in Apache Tomcat.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01705 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-20

TI-2026-31689 CVE-2026-43515 · GHSA-5m62-pw8w-7w9f

MEDIUM 50

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01221 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-285

TI-2026-31687 CVE-2026-43513 · GHSA-5mp6-jrq3-r938

LOW 39

Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00503 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-178

TI-2026-30781 CVE-2026-42498 · GHSA-fv25-8xcx-gqjc

LOW 39

Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00691 Published 2026-05-12 Partial fix · 9.0.118, 10.1.55 +1 CWE-200

TI-2026-25438 CVE-2026-32990 · GHSA-8mc5-53m5-3qj2

LOW 30

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00313 Published 2026-04-09 Partial fix · 9.0.116, 10.1.53 +1 CWE-20