Vulnerability-Lookup

RHSA-2026:68257

Vulnerability from csaf_redhat - Published: 2026-09-16 15:12 - Updated: 2026-09-29 18:47

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: tomcat10: * tomcat10-10.1.60-0.1.hum1 (noarch) * tomcat10-admin-webapps-10.1.60-0.1.hum1 (noarch) * tomcat10-common-10.1.60-0.1.hum1 (noarch) * tomcat10-docs-webapp-10.1.60-0.1.hum1 (noarch) * tomcat10-el-5.0-api-10.1.60-0.1.hum1 (noarch) * tomcat10-jsp-3.1-api-10.1.60-0.1.hum1 (noarch) * tomcat10-lib-10.1.60-0.1.hum1 (noarch) * tomcat10-servlet-6.0-api-10.1.60-0.1.hum1 (noarch) * tomcat10-user-instance-10.1.60-0.1.hum1 (noarch) * tomcat10-webapps-10.1.60-0.1.hum1 (noarch) * tomcat10-10.1.60-0.1.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-41284

In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service (DoS), making the affected system unavailable to legitimate users.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 21 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-68569

A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized access to the system.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE-305 - Authentication Bypass by Primary Weakness

Affected products

Fixed 21 products, the same list as for CVE-2026-41284

Threats

Impact Important

CVE-2026-73581

A flaw was found in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM Transport Layer Security (TLS) implementations fail to properly check Certificate Revocation Lists (CRLs) when a certificate uses a keystore. This oversight could allow an attacker to use a revoked certificate, potentially leading to unauthorized access or impersonation of a legitimate server or client.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 21 products, the same list as for CVE-2026-41284

Threats

Impact Moderate

CVE-2026-75973

A flaw was found in Apache Tomcat. When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications utilize it, an improper authentication vulnerability arises. This issue causes the authentication realm established for the first web application to be incorrectly applied to all subsequent web applications. Consequently, this could lead to unauthorized access or incorrect authorization decisions across different web applications.

CWE-305 - Authentication Bypass by Primary Weakness

Affected products

Fixed 21 products, the same list as for CVE-2026-41284

Threats

Impact Low

CVE-2026-76183

A flaw was found in Apache Tomcat. This vulnerability, known as an 'Authentication Bypass by Alternate Name', allows an attacker to bypass the security restrictions set for WebSocket endpoints. This means that unauthorized users could gain access to protected resources or functionality, potentially leading to sensitive information disclosure or other unauthorized actions.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-289 - Authentication Bypass by Alternate Name

Affected products

Fixed 21 products, the same list as for CVE-2026-41284

Threats

Impact Important

CVE-2026-77756

A flaw was found in Apache Tomcat. This vulnerability, known as HTTP Request/Response Smuggling, occurs when Tomcat processes the transfer-encoding header for an HTTP/1.0 request while operating behind a reverse proxy. A remote attacker could exploit this to cause a denial of service, leading to one user's request failing due to interference from another user's request.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 21 products, the same list as for CVE-2026-41284

Threats

Impact Moderate

CVE-2026-77791

A flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability occurs when sending a WebSocket close message, which can lead to a busy wait condition. A remote attacker could exploit this to cause a Denial of Service (DoS) by making the server unresponsive.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 21 products, the same list as for CVE-2026-41284

Threats

Impact Important

CVE-2026-78383

A flaw was found in Apache Tomcat. An unauthenticated remote attacker can send a specially crafted AJP (Apache JServ Protocol) request, causing an AJP processing thread to become unresponsive. This resource exhaustion can lead to a denial of service (DoS), making the server unavailable to legitimate users.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 21 products, the same list as for CVE-2026-41284

Threats

Impact Important

CVE-2026-78437

A flaw was found in Apache Tomcat. An incomplete cleanup vulnerability allows a remote attacker to send a malformed HTTP/2 request. This can potentially cause a denial of service, leading to one request from another user failing.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-459 - Incomplete Cleanup

Affected products

Fixed 21 products, the same list as for CVE-2026-41284

Threats

Impact Moderate

CVE-2026-79677

A flaw was found in Apache Tomcat. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by exploiting lost timeouts for asynchronous WebSocket writes. This can lead to the affected system becoming unresponsive or unavailable.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-772 - Missing Release of Resource after Effective Lifetime

Affected products

Fixed 21 products, the same list as for CVE-2026-41284

Threats

Impact Moderate

CVE-2026-86350

A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security mechanisms or gain unauthorized access to sensitive information.

7.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 21 products, the same list as for CVE-2026-41284

Threats

Impact Important

CVE-2026-87022

A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the 'per-message-deflate' extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into WebSocket communications, potentially leading to unauthorized actions or information disclosure.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-130 - Improper Handling of Length Parameter Inconsistency

Affected products

Fixed 21 products, the same list as for CVE-2026-41284

Threats

Impact Low

References

78 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:68257	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-68569	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/cve/CVE-2026-41284	external
https://access.redhat.com/security/cve/CVE-2026-79677	external
https://access.redhat.com/security/cve/CVE-2026-76183	external
https://access.redhat.com/security/cve/CVE-2026-78437	external
https://access.redhat.com/security/cve/CVE-2026-86350	external
https://access.redhat.com/security/cve/CVE-2026-87022	external
https://access.redhat.com/security/cve/CVE-2026-78383	external
https://access.redhat.com/security/cve/CVE-2026-77791	external
https://access.redhat.com/security/cve/CVE-2026-73581	external
https://access.redhat.com/security/cve/CVE-2026-75973	external
https://access.redhat.com/security/cve/CVE-2026-77756	external
https://access.redhat.com/security/cve/CVE-2026-86248	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-41284	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476518	external
https://www.cve.org/CVERecord?id=CVE-2026-41284	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41284	external
https://lists.apache.org/thread/2nvqjr7ovjmvx2vbh…	external
https://access.redhat.com/security/cve/CVE-2026-68569	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524160	external
https://www.cve.org/CVERecord?id=CVE-2026-68569	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68569	external
https://lists.apache.org/thread/8robqo76q0osxgw0b…	external
https://access.redhat.com/security/cve/CVE-2026-73581	self
https://bugzilla.redhat.com/show_bug.cgi?id=2539356	external
https://www.cve.org/CVERecord?id=CVE-2026-73581	external
https://nvd.nist.gov/vuln/detail/CVE-2026-73581	external
https://lists.apache.org/thread/r0dj3h1pbn4wv96fh…	external
https://access.redhat.com/security/cve/CVE-2026-75973	self
https://bugzilla.redhat.com/show_bug.cgi?id=2539354	external
https://www.cve.org/CVERecord?id=CVE-2026-75973	external
https://nvd.nist.gov/vuln/detail/CVE-2026-75973	external
https://lists.apache.org/thread/njjcdkkzqyzx4n3ff…	external
https://access.redhat.com/security/cve/CVE-2026-76183	self
https://bugzilla.redhat.com/show_bug.cgi?id=2539355	external
https://www.cve.org/CVERecord?id=CVE-2026-76183	external
https://nvd.nist.gov/vuln/detail/CVE-2026-76183	external
https://lists.apache.org/thread/45mxk8nj2q8pkhct6…	external
https://access.redhat.com/security/cve/CVE-2026-77756	self
https://bugzilla.redhat.com/show_bug.cgi?id=2539351	external
https://www.cve.org/CVERecord?id=CVE-2026-77756	external
https://nvd.nist.gov/vuln/detail/CVE-2026-77756	external
https://lists.apache.org/thread/bl5b6rxqh3vb2k9bj…	external
https://access.redhat.com/security/cve/CVE-2026-77791	self
https://bugzilla.redhat.com/show_bug.cgi?id=2539396	external
https://www.cve.org/CVERecord?id=CVE-2026-77791	external
https://nvd.nist.gov/vuln/detail/CVE-2026-77791	external
https://lists.apache.org/thread/mb1pjjooqytrl6hbv…	external
https://access.redhat.com/security/cve/CVE-2026-78383	self
https://bugzilla.redhat.com/show_bug.cgi?id=2539486	external
https://www.cve.org/CVERecord?id=CVE-2026-78383	external
https://nvd.nist.gov/vuln/detail/CVE-2026-78383	external
https://lists.apache.org/thread/tyqcqk99g7ghgk226…	external
https://access.redhat.com/security/cve/CVE-2026-78437	self
https://bugzilla.redhat.com/show_bug.cgi?id=2539533	external
https://www.cve.org/CVERecord?id=CVE-2026-78437	external
https://nvd.nist.gov/vuln/detail/CVE-2026-78437	external
https://lists.apache.org/thread/qkmsos3s8chn5053q…	external
https://access.redhat.com/security/cve/CVE-2026-79677	self
https://bugzilla.redhat.com/show_bug.cgi?id=2539616	external
https://www.cve.org/CVERecord?id=CVE-2026-79677	external
https://nvd.nist.gov/vuln/detail/CVE-2026-79677	external
http://www.openwall.com/lists/oss-security/2026/0…	external
https://lists.apache.org/thread/bzwps6ck4szf2hmks…	external
https://access.redhat.com/security/cve/CVE-2026-86350	self
https://bugzilla.redhat.com/show_bug.cgi?id=2539370	external
https://www.cve.org/CVERecord?id=CVE-2026-86350	external
https://nvd.nist.gov/vuln/detail/CVE-2026-86350	external
https://lists.apache.org/thread/mss45z99lcdd5dtpg…	external
https://access.redhat.com/security/cve/CVE-2026-87022	self
https://bugzilla.redhat.com/show_bug.cgi?id=2539373	external
https://www.cve.org/CVERecord?id=CVE-2026-87022	external
https://nvd.nist.gov/vuln/detail/CVE-2026-87022	external
https://lists.apache.org/thread/ypvlkjqsq0480fnk9…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ntomcat10:\n  * tomcat10-10.1.60-0.1.hum1 (noarch)\n  * tomcat10-admin-webapps-10.1.60-0.1.hum1 (noarch)\n  * tomcat10-common-10.1.60-0.1.hum1 (noarch)\n  * tomcat10-docs-webapp-10.1.60-0.1.hum1 (noarch)\n  * tomcat10-el-5.0-api-10.1.60-0.1.hum1 (noarch)\n  * tomcat10-jsp-3.1-api-10.1.60-0.1.hum1 (noarch)\n  * tomcat10-lib-10.1.60-0.1.hum1 (noarch)\n  * tomcat10-servlet-6.0-api-10.1.60-0.1.hum1 (noarch)\n  * tomcat10-user-instance-10.1.60-0.1.hum1 (noarch)\n  * tomcat10-webapps-10.1.60-0.1.hum1 (noarch)\n  * tomcat10-10.1.60-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:68257",
        "url": "https://access.redhat.com/errata/RHSA-2026:68257"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-68569",
        "url": "https://access.redhat.com/security/cve/CVE-2026-68569"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41284",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41284"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-79677",
        "url": "https://access.redhat.com/security/cve/CVE-2026-79677"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-76183",
        "url": "https://access.redhat.com/security/cve/CVE-2026-76183"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-78437",
        "url": "https://access.redhat.com/security/cve/CVE-2026-78437"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86350",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86350"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-87022",
        "url": "https://access.redhat.com/security/cve/CVE-2026-87022"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-78383",
        "url": "https://access.redhat.com/security/cve/CVE-2026-78383"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-77791",
        "url": "https://access.redhat.com/security/cve/CVE-2026-77791"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73581",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73581"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-75973",
        "url": "https://access.redhat.com/security/cve/CVE-2026-75973"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-77756",
        "url": "https://access.redhat.com/security/cve/CVE-2026-77756"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-86248",
        "url": "https://access.redhat.com/security/cve/CVE-2026-86248"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68257.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-09-29T18:47:50+00:00",
      "generator": {
        "date": "2026-09-29T18:47:50+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:68257",
      "initial_release_date": "2026-09-16T15:12:00+00:00",
      "revision_history": [
        {
          "date": "2026-09-16T15:12:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-29T07:38:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-29T18:47:50+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-admin-webapps@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-admin-webapps@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-common@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-common@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-docs-webapp@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-docs-webapp@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-el-5.0-api@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-el-5.0-api@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-jsp-3.1-api@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-jsp-3.1-api@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-lib@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-lib@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-servlet-6.0-api@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-servlet-6.0-api@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-user-instance@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-user-instance@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-webapps@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10-webapps@10.1.60-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat10-0:10.1.60-0.1.hum1@src",
                "product": {
                  "name": "tomcat10-0:10.1.60-0.1.hum1@src",
                  "product_id": "tomcat10-0:10.1.60-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10@10.1.60-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-0:10.1.60-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src"
        },
        "product_reference": "tomcat10-0:10.1.60-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-41284",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-12T16:01:43.841831+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476518"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service (DoS), making the affected system unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41284"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476518",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476518"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41284",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41284"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc",
          "url": "https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc"
        }
      ],
      "release_date": "2026-05-12T15:14:45.278000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:12:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68257"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation"
    },
    {
      "cve": "CVE-2026-68569",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "discovery_date": "2026-08-25T22:01:58.059796+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized access to the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Apache Tomcat allows unauthorized access when configured with CLIENT-CERT or SPNEGO authentication alongside a DataSourceRealm. This flaw could permit a user to be authenticated even if their account does not exist, bypassing intended security controls in Red Hat deployments where these specific configurations are in use.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68569"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68569",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68569"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68569",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68569"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc",
          "url": "https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc"
        }
      ],
      "release_date": "2026-08-25T21:59:17.438000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:12:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68257"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid using CLIENT-CERT or SPNEGO authentication methods with the DataSourceRealm in Apache Tomcat. Alternatively, restrict network access to the Apache Tomcat instance to trusted clients only, thereby limiting exposure to potential attackers. If changes are made to the Tomcat configuration, a service restart may be required for the changes to take effect.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure"
    },
    {
      "cve": "CVE-2026-73581",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-09-23T11:31:24.479771+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539356"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM Transport Layer Security (TLS) implementations fail to properly check Certificate Revocation Lists (CRLs) when a certificate uses a keystore. This oversight could allow an attacker to use a revoked certificate, potentially leading to unauthorized access or impersonation of a legitimate server or client.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73581"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539356",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539356"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73581",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73581"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73581",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73581"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do",
          "url": "https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do"
        }
      ],
      "release_date": "2026-09-23T11:08:53.212000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:12:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68257"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists"
    },
    {
      "cve": "CVE-2026-75973",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "discovery_date": "2026-09-23T11:31:48.035668+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539354"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications utilize it, an improper authentication vulnerability arises. This issue causes the authentication realm established for the first web application to be incorrectly applied to all subsequent web applications. Consequently, this could lead to unauthorized access or incorrect authorization decisions across different web applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Cross-context authentication mix-up via Jakarta Authentication misconfiguration",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75973"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539354",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539354"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75973",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75973"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75973",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75973"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/njjcdkkzqyzx4n3ffc4ffjmyh5mpl1gr",
          "url": "https://lists.apache.org/thread/njjcdkkzqyzx4n3ffc4ffjmyh5mpl1gr"
        }
      ],
      "release_date": "2026-09-23T11:14:07.995000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:12:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68257"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Cross-context authentication mix-up via Jakarta Authentication misconfiguration"
    },
    {
      "cve": "CVE-2026-76183",
      "cwe": {
        "id": "CWE-289",
        "name": "Authentication Bypass by Alternate Name"
      },
      "discovery_date": "2026-09-23T11:31:14.311894+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539355"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This vulnerability, known as an \u0027Authentication Bypass by Alternate Name\u0027, allows an attacker to bypass the security restrictions set for WebSocket endpoints. This means that unauthorized users could gain access to protected resources or functionality, potentially leading to sensitive information disclosure or other unauthorized actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having an Important severity because unauthenticated remote attackers can circumvent access control constraints protecting WebSocket endpoints, posing significant risks to application data confidentiality and integrity. The issue specifically impacts Red Hat Enterprise Linux and JBoss Web Server environments where deployed applications configure container-managed security restrictions on WebSocket communication channels. Standard HTTP endpoints and applications that do not utilize WebSocket functionality remain unaffected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-76183"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539355",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539355"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-76183",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-76183"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76183",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76183"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp",
          "url": "https://lists.apache.org/thread/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp"
        }
      ],
      "release_date": "2026-09-23T11:16:09.907000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:12:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68257"
        },
        {
          "category": "workaround",
          "details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints"
    },
    {
      "cve": "CVE-2026-77756",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-09-23T11:30:58.279506+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539351"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This vulnerability, known as HTTP Request/Response Smuggling, occurs when Tomcat processes the transfer-encoding header for an HTTP/1.0 request while operating behind a reverse proxy. A remote attacker could exploit this to cause a denial of service, leading to one user\u0027s request failing due to interference from another user\u0027s request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Request smuggling vulnerability can lead to denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77756"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539351",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539351"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77756",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77756"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77756",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77756"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/bl5b6rxqh3vb2k9bj2794vhor7o6xl3z",
          "url": "https://lists.apache.org/thread/bl5b6rxqh3vb2k9bj2794vhor7o6xl3z"
        }
      ],
      "release_date": "2026-09-23T11:18:02.672000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:12:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68257"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: Request smuggling vulnerability can lead to denial of service"
    },
    {
      "cve": "CVE-2026-77791",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-09-23T13:01:04.663769+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539396"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability occurs when sending a WebSocket close message, which can lead to a busy wait condition. A remote attacker could exploit this to cause a Denial of Service (DoS) by making the server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Important because an unauthenticated remote client can cause severe CPU starvation and exhaust worker threads without requiring administrative privileges. Exploitation occurs during the termination of WebSocket sessions, forcing the application server into an infinite busy-wait loop that degrades availability for all hosted applications. Deployments are primarily exposed when running web applications that define WebSocket endpoints accessible over untrusted public networks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77791"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539396",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539396"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77791",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77791"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77791",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77791"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/mb1pjjooqytrl6hbvbt3rw1lqwlon4cz",
          "url": "https://lists.apache.org/thread/mb1pjjooqytrl6hbvbt3rw1lqwlon4cz"
        }
      ],
      "release_date": "2026-09-23T11:20:50.457000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:12:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68257"
        },
        {
          "category": "workaround",
          "details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close"
    },
    {
      "cve": "CVE-2026-78383",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-23T15:51:02.902018+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539486"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. An unauthenticated remote attacker can send a specially crafted AJP (Apache JServ Protocol) request, causing an AJP processing thread to become unresponsive. This resource exhaustion can lead to a denial of service (DoS), making the server unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Denial of Service via AJP request",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having Important impact because an unauthenticated remote attacker can exhaust connector thread pools without authentication, resulting in complete denial of service for the application server. In Red Hat Enterprise Linux and JBoss Web Server environments, the AJP connector is typically disabled by default or bound to loopback interfaces, limiting exposure unless explicitly configured to accept external connections. Consequently, deployments are primarily susceptible when Tomcat services expose AJP listener ports to untrusted networks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78383"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539486",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539486"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78383",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78383"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78383",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78383"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/tyqcqk99g7ghgk22641vf67vghcyswnw",
          "url": "https://lists.apache.org/thread/tyqcqk99g7ghgk22641vf67vghcyswnw"
        }
      ],
      "release_date": "2026-09-23T11:23:15.477000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:12:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68257"
        },
        {
          "category": "workaround",
          "details": "This issue can be mitigated by disabling AJP connector or restricting access to it to only trusted AJP clients.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Denial of Service via AJP request"
    },
    {
      "cve": "CVE-2026-78437",
      "cwe": {
        "id": "CWE-459",
        "name": "Incomplete Cleanup"
      },
      "discovery_date": "2026-09-23T16:46:03.668688+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539533"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. An incomplete cleanup vulnerability allows a remote attacker to send a malformed HTTP/2 request. This can potentially cause a denial of service, leading to one request from another user failing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Denial of Service via malformed HTTP/2 request",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78437"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539533",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539533"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78437",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78437"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78437",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78437"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/qkmsos3s8chn5053qr466rzwv6sk5gjg",
          "url": "https://lists.apache.org/thread/qkmsos3s8chn5053qr466rzwv6sk5gjg"
        }
      ],
      "release_date": "2026-09-23T11:26:29.362000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:12:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68257"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: Denial of Service via malformed HTTP/2 request"
    },
    {
      "cve": "CVE-2026-79677",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-09-23T18:23:03.450036+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539616"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by exploiting lost timeouts for asynchronous WebSocket writes. This can lead to the affected system becoming unresponsive or unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-79677"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539616",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539616"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-79677",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-79677"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-79677",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79677"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/09/23/27",
          "url": "http://www.openwall.com/lists/oss-security/2026/09/23/27"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/bzwps6ck4szf2hmksbbon3syyl9qnkv8",
          "url": "https://lists.apache.org/thread/bzwps6ck4szf2hmksbbon3syyl9qnkv8"
        }
      ],
      "release_date": "2026-09-23T11:28:03.338000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:12:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68257"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts"
    },
    {
      "cve": "CVE-2026-86350",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-09-23T11:50:57.039780+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539370"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security mechanisms or gain unauthorized access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having Important impact because unauthenticated remote clients can trigger request desynchronization and header confusion across multiplexed connections, leading to potential access control bypass or data leakage across sessions. Exploitation is limited to instances actively serving HTTP/2 connections, commonly deployed in reverse proxy architectures or direct HTTPS terminations. Instances using standard HTTP/1.1 connector definitions without explicit HTTP/2 protocol upgrade handlers are not exposed to this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86350"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539370",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539370"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86350",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86350"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86350",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86350"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc",
          "url": "https://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc"
        }
      ],
      "release_date": "2026-09-23T11:31:36.328000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:12:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68257"
        },
        {
          "category": "workaround",
          "details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up"
    },
    {
      "cve": "CVE-2026-87022",
      "cwe": {
        "id": "CWE-130",
        "name": "Improper Handling of Length Parameter Inconsistency"
      },
      "discovery_date": "2026-09-23T11:51:20.721276+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2539373"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the \u0027per-message-deflate\u0027 extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into WebSocket communications, potentially leading to unauthorized actions or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87022"
        },
        {
          "category": "external",
          "summary": "RHBZ#2539373",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539373"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87022",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87022"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87022",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87022"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/ypvlkjqsq0480fnk9jm6h9qllddwlw4w",
          "url": "https://lists.apache.org/thread/ypvlkjqsq0480fnk9jm6h9qllddwlw4w"
        }
      ],
      "release_date": "2026-09-23T11:32:55.485000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T15:12:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68257"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-0:10.1.60-0.1.hum1@src",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-common-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-el-5.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-lib-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-user-instance-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:tomcat10-webapps-0:10.1.60-0.1.hum1@noarch@public-hummingbird-x86_64-rpms"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling"
    }
  ]
}

CVE-2026-41284 (GCVE-0-2026-41284)

Vulnerability from cvelistv5 – Published: 2026-05-12 15:14 – Updated: 2026-05-13 15:57

Title

Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Summary

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:57 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/2nvqjr7ovjmvx2vbh…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.21 (semver) Affected: 10.1.0-M1 , ≤ 10.1.54 (semver) Affected: 9.0.0.M1 , ≤ 9.0.117 (semver) Affected: 10.0.0-M1 , ≤ 10.0.27 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Affected: 4.0 , ≤ 7.0.109 (semver)

Credits

Dariusz Gońda

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-12T17:40:56.383Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/12/12"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-41284",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:57:41.987314Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:57:45.607Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.21",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.54",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.117",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.0.27",
              "status": "affected",
              "version": "10.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dariusz Go\u0144da"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.\u003cbr\u003eOlder, unsupported versions may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.\nOlder, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T15:14:45.278Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-41284",
    "datePublished": "2026-05-12T15:14:45.278Z",
    "dateReserved": "2026-04-20T07:27:43.961Z",
    "dateUpdated": "2026-05-13T15:57:45.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68569 (GCVE-0-2026-68569)

Vulnerability from cvelistv5 – Published: 2026-08-25 21:59 – Updated: 2026-09-21 11:06

Title

Apache Tomcat: Principal lookup can fail open in some cases

Summary

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 18:38 UTC

CWE

CWE-287 - Improper Authentication

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/8robqo76q0osxgw0b…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/08/26/8

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.24 (semver) Affected: 10.1.0-M1 , ≤ 10.1.57 (semver) Affected: 9.0.0.M1 , ≤ 9.0.120 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Affected: 7.0.0 , ≤ 7.0.109 (semver) Unknown: 0 , < 7.0.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-26T02:30:40.822Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/26/8"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-68569",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:38:39.170628Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T18:38:54.931Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.24",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.57",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.120",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T11:06:13.066Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Principal lookup can fail open in some cases",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-68569",
    "datePublished": "2026-08-25T21:59:17.438Z",
    "dateReserved": "2026-07-31T07:51:47.785Z",
    "dateUpdated": "2026-09-21T11:06:13.066Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73581 (GCVE-0-2026-73581)

Vulnerability from cvelistv5 – Published: 2026-09-23 11:08 – Updated: 2026-09-23 18:10

Title

Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore

Summary

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 15:19 UTC

CWE

CWE-299 - Improper Check for Certificate Revocation

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/r0dj3h1pbn4wv96fh…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.25 (semver) Affected: 10.1.0-M1 , ≤ 10.1.59 (semver) Affected: 9.0.0.M1 , ≤ 9.0.121 (semver) Affected: 8.5.0 , ≤ 8.50.100 (semver) Unaffected: 0 , ≤ 8.5.0 (semver)

Credits

arpitjain099 (https://github.com/arpitjain099)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-73581",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T15:19:35.322766Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T15:19:40.273Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-23T18:10:39.638Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/23/19"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.25",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.59",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.121",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.50.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "arpitjain099 (https://github.com/arpitjain099)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121.\u003c/p\u003e\u003cp\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100.\u0026nbsp;Other unsupported versions may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100.\u00a0Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-299",
              "description": "CWE-299 Improper Check for Certificate Revocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T11:08:53.212Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-73581",
    "datePublished": "2026-09-23T11:08:53.212Z",
    "dateReserved": "2026-08-13T07:31:17.111Z",
    "dateUpdated": "2026-09-23T18:10:39.638Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-75973 (GCVE-0-2026-75973)

Vulnerability from cvelistv5 – Published: 2026-09-23 11:14 – Updated: 2026-09-23 18:10

Title

Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured

Summary

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 15:28 UTC

CWE

CWE-287 - Improper Authentication

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/njjcdkkzqyzx4n3ff…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.25 (semver) Affected: 10.1.0-M1 , ≤ 10.1.59 (semver) Affected: 9.0.0.M4 , ≤ 9.0.121 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Unaffected: 0 , ≤ 7.0.109 (semver)

Credits

0xCc.zhang

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-75973",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T15:28:51.510257Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T15:29:15.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-23T18:10:40.767Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/23/20"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.25",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.59",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.121",
              "status": "affected",
              "version": "9.0.0.M4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "0xCc.zhang"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121.\u003c/p\u003e\u003cp\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T11:14:07.995Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/njjcdkkzqyzx4n3ffc4ffjmyh5mpl1gr"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-75973",
    "datePublished": "2026-09-23T11:14:07.995Z",
    "dateReserved": "2026-08-18T17:47:34.591Z",
    "dateUpdated": "2026-09-23T18:10:40.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76183 (GCVE-0-2026-76183)

Vulnerability from cvelistv5 – Published: 2026-09-23 11:16 – Updated: 2026-09-23 18:10

Title

Apache Tomcat: Bypass of security constraints for WebSocket endpoints

Summary

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 15:33 UTC

CWE

CWE-289 - Authentication Bypass by Alternate Name

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/45mxk8nj2q8pkhct6…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.25 (semver) Affected: 10.1.0-M1 , ≤ 10.1.59 (semver) Affected: 9.0.0.M1 , ≤ 9.0.121 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Affected: 7.0.43 , ≤ 7.0.109 (semver) Affected: 0 , < 7.0.43 (semver)

Credits

Zhang Yilin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-76183",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T15:33:34.949308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T15:37:17.161Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-23T18:10:41.803Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/23/21"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.25",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.59",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.121",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.43",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.43",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhang Yilin"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAuthentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\u003c/p\u003e\u003cp\u003eThe following versions were EOS at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOS at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-289",
              "description": "CWE-289 Authentication Bypass by Alternate Name",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T12:19:55.043Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Bypass of security constraints for WebSocket endpoints",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-76183",
    "datePublished": "2026-09-23T11:16:09.907Z",
    "dateReserved": "2026-08-19T10:37:56.319Z",
    "dateUpdated": "2026-09-23T18:10:41.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77756 (GCVE-0-2026-77756)

Vulnerability from cvelistv5 – Published: 2026-09-23 11:18 – Updated: 2026-09-23 18:10

Title

Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests

Summary

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 13:18 UTC

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/bl5b6rxqh3vb2k9bj…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.25 (semver) Affected: 10.1.0-M1 , ≤ 10.1.59 (semver) Affected: 9.0.47 , ≤ 9.0.121 (semver) Affected: 8.5.67 , ≤ 8.5.100 (semver) Unaffected: 0 , ≤ 7.0.109 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 3.7,
              "baseSeverity": "LOW",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-77756",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T13:18:16.430403Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T13:18:19.230Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-23T18:10:42.842Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/23/22"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.25",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.59",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.121",
              "status": "affected",
              "version": "9.0.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.\u003c/p\u003e\u003cp\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T11:18:02.672Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/bl5b6rxqh3vb2k9bj2794vhor7o6xl3z"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-77756",
    "datePublished": "2026-09-23T11:18:02.672Z",
    "dateReserved": "2026-08-21T09:55:42.227Z",
    "dateUpdated": "2026-09-23T18:10:42.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77791 (GCVE-0-2026-77791)

Vulnerability from cvelistv5 – Published: 2026-09-23 11:20 – Updated: 2026-09-23 18:10

Title

Apache Tomcat: DoS via busy wait during WebSocket close

Summary

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.88 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 12:44 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/mb1pjjooqytrl6hbv…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M5 , ≤ 11.0.25 (semver) Affected: 10.1.8 , ≤ 10.1.59 (semver) Affected: 9.0.74 , ≤ 9.0.121 (semver) Affected: 8.5.88 , ≤ 8.5.100 (semver) Unaffected: 0 , ≤ 7.0.109 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-77791",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T12:44:33.453302Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T12:50:22.374Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-23T18:10:44.739Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/23/24"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.25",
              "status": "affected",
              "version": "11.0.0-M5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.59",
              "status": "affected",
              "version": "10.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.121",
              "status": "affected",
              "version": "9.0.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121.\u003c/p\u003e\u003cp\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.88 through 8.5.100. Other unsupported versions may also be affected.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.88 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T11:20:50.457Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/mb1pjjooqytrl6hbvbt3rw1lqwlon4cz"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Apache Tomcat: DoS via busy wait during WebSocket close",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-77791",
    "datePublished": "2026-09-23T11:20:50.457Z",
    "dateReserved": "2026-08-21T12:38:02.420Z",
    "dateUpdated": "2026-09-23T18:10:44.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78383 (GCVE-0-2026-78383)

Vulnerability from cvelistv5 – Published: 2026-09-23 11:23 – Updated: 2026-09-23 18:10

Title

Apache Tomcat: AJP DoS via missing request body

Summary

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 15:44 UTC

CWE

CWE-770 - Allocation of resources without limits or throttling

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/tyqcqk99g7ghgk226…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.25 (semver) Affected: 10.1.0-M1 , ≤ 10.1.59 (semver) Affected: 9.0.0.M1 , ≤ 9.0.121 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Affected: 7.0.0 , ≤ 7.0.109 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-78383",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T15:44:38.108504Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T15:44:44.048Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-23T18:10:45.708Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/23/25"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.25",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.59",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.121",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of resources without limits or throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T11:23:15.477Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/tyqcqk99g7ghgk22641vf67vghcyswnw"
        }
      ],
      "source": {
        "defect": [
          "lo"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Tomcat: AJP DoS via missing request body",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-78383",
    "datePublished": "2026-09-23T11:23:15.477Z",
    "dateReserved": "2026-08-24T13:38:58.809Z",
    "dateUpdated": "2026-09-23T18:10:45.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78437 (GCVE-0-2026-78437)

Vulnerability from cvelistv5 – Published: 2026-09-23 11:26 – Updated: 2026-09-23 18:10

Title

Apache Tomcat: HTTP/2 DoS via malformed request

Summary

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 16:25 UTC

CWE

CWE-459 - Incomplete cleanup

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/qkmsos3s8chn5053q…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.19 , ≤ 11.0.25 (semver) Affected: 10.1.53 , ≤ 10.1.59 (semver) Affected: 9.0.116 , ≤ 9.0.121 (semver) Unaffected: 0 , ≤ 8.5.100 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-78437",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T16:25:38.365317Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T16:25:54.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-23T18:10:46.744Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/23/26"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.25",
              "status": "affected",
              "version": "11.0.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.59",
              "status": "affected",
              "version": "10.1.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.121",
              "status": "affected",
              "version": "9.0.116",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIncomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-459",
              "description": "CWE-459 Incomplete cleanup",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T11:26:29.362Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/qkmsos3s8chn5053qr466rzwv6sk5gjg"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Apache Tomcat: HTTP/2 DoS via malformed request",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-78437",
    "datePublished": "2026-09-23T11:26:29.362Z",
    "dateReserved": "2026-08-24T16:10:49.885Z",
    "dateUpdated": "2026-09-23T18:10:46.744Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79677 (GCVE-0-2026-79677)

Vulnerability from cvelistv5 – Published: 2026-09-23 11:28 – Updated: 2026-09-23 18:10

Title

Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout

Summary

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 16:05 UTC

CWE

CWE-772 - Missing release of resource after effective lifetime
CWE-1025 - Comparison using wrong factors

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/bzwps6ck4szf2hmks…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.25 (semver) Affected: 10.1.0-M1 , ≤ 10.1.59 (semver) Affected: 9.0.0.M1 , ≤ 9.0.121 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Affected: 7.0.43 , ≤ 7.0.109 (semver) Unaffected: 0 , < 7.0.43 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-79677",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T16:05:21.474452Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T16:08:11.343Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-23T18:10:47.712Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/23/27"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.25",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.59",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.121",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.43",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.43",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\u003c/p\u003e\u003cp\u003eThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109.\u0026nbsp;Other unsupported versions may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109.\u00a0Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-772",
              "description": "CWE-772 Missing release of resource after effective lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1025",
              "description": "CWE-1025 Comparison using wrong factors",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T11:28:03.338Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/bzwps6ck4szf2hmksbbon3syyl9qnkv8"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-79677",
    "datePublished": "2026-09-23T11:28:03.338Z",
    "dateReserved": "2026-08-25T11:23:12.731Z",
    "dateUpdated": "2026-09-23T18:10:47.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:68257

CVE-2026-41284 (GCVE-0-2026-41284)

CVE-2026-68569 (GCVE-0-2026-68569)

CVE-2026-73581 (GCVE-0-2026-73581)

CVE-2026-75973 (GCVE-0-2026-75973)

CVE-2026-76183 (GCVE-0-2026-76183)

CVE-2026-77756 (GCVE-0-2026-77756)

CVE-2026-77791 (GCVE-0-2026-77791)

CVE-2026-78383 (GCVE-0-2026-78383)

CVE-2026-78437 (GCVE-0-2026-78437)

CVE-2026-79677 (GCVE-0-2026-79677)

Tags

Sightings

Nomenclature

Related by attack behaviour