RHSA-2026:49951
Vulnerability from csaf_redhat - Published: 2026-08-05 13:15 - Updated: 2026-08-05 18:45Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.1 release and security update
Severity
Moderate
Notes
Topic: Red Hat JBoss Web Server 7.0.1 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 7.0.1 serves as a replacement for Red Hat JBoss Web Server 7.0.0. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.
Security Fix(es):
* tomcat-catalina: Apache Tomcat: Misleading security logs due to incorrect control flow (CVE-2026-55276)
* tomcat-coyote-ffm: Apache Tomcat: Error condition not handled when configuring CRLs (CVE-2026-53434)
* tomcat-catalina: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing (CVE-2026-53404)
* tomcat: Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass (CVE-2026-59083)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Apache Tomcat's rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended rule processing, potentially allowing for security bypasses or unauthorized access due to misapplied configurations.
6.5 (Medium)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists (CRLs) for a FFM (presumably a specific type of connector), the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security controls might not be properly enforced.
CWE-390 - Detection of Error Condition Without ActionAffected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might misinterpret the actual authorization constraints, potentially impacting the security posture of the application.
CWE-778 - Insufficient LoggingAffected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding (hex encoding). A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actions that should be restricted.
CWE-807 - Reliance on Untrusted Inputs in a Security DecisionAffected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
References
28 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Web Server 7.0.1 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 7.0.1 serves as a replacement for Red Hat JBoss Web Server 7.0.0. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.\n\nSecurity Fix(es):\n\n* tomcat-catalina: Apache Tomcat: Misleading security logs due to incorrect control flow (CVE-2026-55276)\n* tomcat-coyote-ffm: Apache Tomcat: Error condition not handled when configuring CRLs (CVE-2026-53434)\n* tomcat-catalina: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing (CVE-2026-53404)\n* tomcat: Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass (CVE-2026-59083)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:49951",
"url": "https://access.redhat.com/errata/RHSA-2026:49951"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/7.0/html/red_hat_jboss_web_server_7.0_service_pack_1_release_notes/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/7.0/html/red_hat_jboss_web_server_7.0_service_pack_1_release_notes/index"
},
{
"category": "external",
"summary": "2494668",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494668"
},
{
"category": "external",
"summary": "2494675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494675"
},
{
"category": "external",
"summary": "2494681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494681"
},
{
"category": "external",
"summary": "2499917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499917"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49951.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.1 release and security update",
"tracking": {
"current_release_date": "2026-08-05T18:45:11+00:00",
"generator": {
"date": "2026-08-05T18:45:11+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:49951",
"initial_release_date": "2026-08-05T13:15:14+00:00",
"revision_history": [
{
"date": "2026-08-05T13:15:14+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-05T13:15:14+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-05T18:45:11+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 7.0 on RHEL 10",
"product": {
"name": "Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:7.0::el10"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 7.0 on RHEL 8",
"product": {
"name": "Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:7.0::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 7.0 on RHEL 9",
"product": {
"name": "Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:7.0::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"product": {
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"product_id": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat@11.0.21-6.redhat_00005.1.el10jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"product": {
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"product_id": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat@11.0.21-6.redhat_00005.1.el8jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"product": {
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"product_id": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat@11.0.21-6.redhat_00005.1.el9jws?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_id": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat@11.0.21-6.redhat_00005.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_id": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-admin-webapps@11.0.21-6.redhat_00005.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_id": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-docs-webapp@11.0.21-6.redhat_00005.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_id": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-el-5.0-api@11.0.21-6.redhat_00005.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_id": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-javadoc@11.0.21-6.redhat_00005.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_id": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-jsp-3.1-api@11.0.21-6.redhat_00005.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_id": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-lib@11.0.21-6.redhat_00005.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_id": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-selinux@11.0.21-6.redhat_00005.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_id": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-servlet-6.0-api@11.0.21-6.redhat_00005.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_id": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-webapps@11.0.21-6.redhat_00005.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_id": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat@11.0.21-6.redhat_00005.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_id": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-admin-webapps@11.0.21-6.redhat_00005.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_id": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-docs-webapp@11.0.21-6.redhat_00005.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_id": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-el-5.0-api@11.0.21-6.redhat_00005.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_id": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-javadoc@11.0.21-6.redhat_00005.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_id": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-jsp-3.1-api@11.0.21-6.redhat_00005.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_id": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-lib@11.0.21-6.redhat_00005.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_id": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-selinux@11.0.21-6.redhat_00005.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_id": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-servlet-6.0-api@11.0.21-6.redhat_00005.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_id": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-webapps@11.0.21-6.redhat_00005.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_id": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat@11.0.21-6.redhat_00005.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_id": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-admin-webapps@11.0.21-6.redhat_00005.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_id": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-docs-webapp@11.0.21-6.redhat_00005.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_id": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-el-5.0-api@11.0.21-6.redhat_00005.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_id": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-javadoc@11.0.21-6.redhat_00005.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_id": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-jsp-3.1-api@11.0.21-6.redhat_00005.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_id": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-lib@11.0.21-6.redhat_00005.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_id": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-selinux@11.0.21-6.redhat_00005.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_id": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-servlet-6.0-api@11.0.21-6.redhat_00005.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_id": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-webapps@11.0.21-6.redhat_00005.1.el9jws?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src"
},
"product_reference": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src"
},
"product_reference": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src"
},
"product_reference": "jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-53404",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2026-06-29T21:01:58.363486+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494681"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat\u0027s rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended rule processing, potentially allowing for security bypasses or unauthorized access due to misapplied configurations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache Tomcat\u0027s RewriteValve. When rewrite rules use OR-chained conditions followed by non-OR conditions, the processing logic may not evaluate conditions correctly, potentially allowing unintended rule matches. Exploitation requires the RewriteValve to be enabled with specific OR-chained condition patterns, which is not a default configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53404"
},
{
"category": "external",
"summary": "RHBZ#2494681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53404"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53404",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53404"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz",
"url": "https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz"
}
],
"release_date": "2026-06-29T20:39:45.317000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T13:15:14+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49951"
},
{
"category": "workaround",
"details": "This vulnerability only affects Tomcat deployments that use the RewriteValve with OR-chained rewrite conditions. Deployments that do not use the RewriteValve are not affected. Review rewrite rules for OR-chained conditions and test rule evaluation behavior.",
"product_ids": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing"
},
{
"cve": "CVE-2026-53434",
"cwe": {
"id": "CWE-390",
"name": "Detection of Error Condition Without Action"
},
"discovery_date": "2026-06-29T21:01:05.687650+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494668"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists (CRLs) for a FFM (presumably a specific type of connector), the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security controls might not be properly enforced.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Error condition not handled when configuring CRLs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache Tomcat. When using the FFM-based connector with CRL-based certificate revocation checking, an error in CRL data processing is not handled correctly, potentially allowing revoked certificates to be accepted. This only affects Tomcat 10.1.0-M7+ and 11.x using the FFM connector (Java 22+ Foreign Function \u0026 Memory API) with CRL configuration \u2014 an extremely narrow set of conditions not present in standard Red Hat deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53434"
},
{
"category": "external",
"summary": "RHBZ#2494668",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494668"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53434",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53434"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk",
"url": "https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk"
}
],
"release_date": "2026-06-29T20:41:06.948000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T13:15:14+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49951"
},
{
"category": "workaround",
"details": "This vulnerability only affects Tomcat deployments using the FFM-based connector (requires Java 22+) with CRL-based certificate revocation checking. Deployments using the standard NIO/NIO2 connectors or not using CRL checking are not affected.",
"product_ids": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Apache Tomcat: Error condition not handled when configuring CRLs"
},
{
"cve": "CVE-2026-55276",
"cwe": {
"id": "CWE-778",
"name": "Insufficient Logging"
},
"discovery_date": "2026-06-29T21:01:38.615799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494675"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might misinterpret the actual authorization constraints, potentially impacting the security posture of the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Apache Tomcat. When the effective web.xml logging feature is enabled for debugging, special roles and empty authorization constraints may be omitted from the logged output. This is a logging-only issue with no runtime security impact \u2014 it only affects the accuracy of debug log output for administrators reviewing the effective web.xml configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55276"
},
{
"category": "external",
"summary": "RHBZ#2494675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55276"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55276",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55276"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v",
"url": "https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v"
}
],
"release_date": "2026-06-29T20:42:23.257000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T13:15:14+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49951"
},
{
"category": "workaround",
"details": "This is a logging-only issue with no runtime security impact. No mitigation is required. Administrators should not rely solely on the effective web.xml debug log output to verify security constraint configuration.",
"product_ids": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow"
},
{
"cve": "CVE-2026-59083",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-07-14T09:01:06.476183+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499917"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding (hex encoding). A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actions that should be restricted.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Low impact vulnerability in Apache Tomcat\u0027s rewrite valve allows a security constraint bypass through improper URL encoding. Exploitation requires specific configurations and has high attack complexity, limiting its overall risk to Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59083"
},
{
"category": "external",
"summary": "RHBZ#2499917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499917"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59083",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59083"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59083",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59083"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq",
"url": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq"
}
],
"release_date": "2026-07-14T08:13:04.861000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T13:15:14+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49951"
},
{
"category": "workaround",
"details": "To mitigate this issue, review Apache Tomcat\u0027s rewrite valve configurations. If the rewrite valve is not essential for your application, consider disabling it. If it is required, ensure its configuration does not permit improper URL encoding that could lead to security constraint bypasses. A service restart may be required for changes to take effect.",
"product_ids": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-6.redhat_00005.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-6.redhat_00005.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-6.redhat_00005.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…