Vulnerability-Lookup

RHSA-2026:68678

Vulnerability from csaf_redhat - Published: 2026-09-17 15:08 - Updated: 2026-09-25 15:32

Summary

Red Hat Security Advisory: tomcat security update

Severity

Important

Notes

Topic: An update for tomcat is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512) * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293) * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498) * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515) * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) * tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957) * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-52316

A flaw was found in Apache Tomcat when configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component. This vulnerability allows authentication bypass via improperly handled exceptions during the authentication process.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-248 - Uncaught Exception

Affected products

Fixed 9 products

Product	Version	Remediation
Unresolved product id: AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch	—	Vendor Fix fix

Threats

Impact Low

CVE-2024-54677

A flaw was found in the "examples" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory (OOM) error, leading to a denial of service.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Low

CVE-2025-46701

A flaw was found in the CGI servlet component of Apache Tomcat. This vulnerability allows a security constraint bypass via improper handling of case sensitivity in the pathInfo component of a URI mapped to the CGI servlet.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-178 - Improper Handling of Case Sensitivity

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2025-55668

A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will occur within the context of the attacker's session. This could allow an attacker to hijack the victim's session and perform actions on their behalf.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-384 - Session Fixation

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2025-55754

An improper input neutralization flaw has been discovered in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.

3.5 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2025-61795

A denial of service flaw has been discovered in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-404 - Improper Resource Shutdown or Release

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2025-66614

A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field. The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-1289 - Improper Validation of Unsafe Equivalence in Input

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2026-24733

A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0.9 protocol can bypass the intended denial rule, enabling an attacker to access resources that should be protected.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-20 - Improper Input Validation

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Low

CVE-2026-24880

A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP requests are processed, potentially leading to the bypassing of security controls, cache poisoning, or other malicious activities.

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Low

CVE-2026-25854

A flaw was found in Apache Tomcat. This open redirect vulnerability allows an attacker to redirect a user to an untrusted site. This occurs through the LoadBalancerDrainingValve, which can be exploited to manipulate URL redirection. The primary impact is that users may be unknowingly directed to malicious websites, potentially leading to phishing attacks or other security compromises.

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Low

CVE-2026-29145

A flaw was found in Apache Tomcat and Apache Tomcat Native. When CLIENT_CERT authentication is configured with "soft fail" disabled, the authentication process may not correctly fail in certain scenarios. This vulnerability could allow an attacker to bypass expected client certificate authentication, potentially leading to unauthorized access to protected resources.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-303 - Incorrect Implementation of Authentication Algorithm

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2026-32990

A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue (CVE-2025-66614). This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application.

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-184 - Incomplete List of Disallowed Inputs

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2026-34483

A flaw was found in the JsonAccessLogValve component of Apache Tomcat. This improper encoding or escaping of output vulnerability could allow an attacker to inject specially crafted data into log files. This could lead to information disclosure or other unintended consequences when the logs are processed or viewed.

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE-838 - Inappropriate Encoding for Output Context

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Low

CVE-2026-34487

A flaw was found in Apache Tomcat. The cloud membership for clustering component was vulnerable to the insertion of sensitive information into log files. This vulnerability could lead to the exposure of the Kubernetes bearer token, which is a credential used for authentication within a Kubernetes cluster, potentially allowing unauthorized access to cluster resources.

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Low

CVE-2026-41284

In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service (DoS), making the affected system unavailable to legitimate users.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Important

CVE-2026-41293

Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid.

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-1286 - Improper Validation of Syntactic Correctness of Input

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2026-42498

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-201 - Insertion of Sensitive Information Into Sent Data

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2026-43512

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-303 - Incorrect Implementation of Authentication Algorithm

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2026-43513

In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-178 - Improper Handling of Case Sensitivity

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2026-43514

A flaw was found in Apache Tomcat. The AJP secret was comparable in non-constant time, allowing an attacker on the local network to mount a timing attack to determine the AJP secret, which may lead to unauthorized access or other security bypasses.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-208 - Observable Timing Discrepancy

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Low

CVE-2026-43515

In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application.

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2026-50229

A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting (XSS), allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to unauthorized access to sensitive information or allow an attacker to alter the content of the website.

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2026-53404

A flaw was found in Apache Tomcat's rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended rule processing, potentially allowing for security bypasses or unauthorized access due to misapplied configurations.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-358 - Improperly Implemented Security Check for Standard

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2026-53434

A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists (CRLs) for a FFM (presumably a specific type of connector), the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security controls might not be properly enforced.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-390 - Detection of Error Condition Without Action

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Low

CVE-2026-55276

A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might misinterpret the actual authorization constraints, potentially impacting the security posture of the application.

2.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

CWE-778 - Insufficient Logging

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Low

CVE-2026-55955

A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component.

4.2 (Medium)


                
                  CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-294 - Authentication Bypass by Capture-replay

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2026-55956

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Moderate

CVE-2026-55957

A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct password, leading to unauthorized access.

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-305 - Authentication Bypass by Primary Weakness

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Important

CVE-2026-59083

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding (hex encoding). A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actions that should be restricted.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-807 - Reliance on Untrusted Inputs in a Security Decision

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Low

CVE-2026-59084

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance, potentially compromising the confidentiality or integrity of data processed by the affected system.

3.8 (Low)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

CWE-1188 - Initialization of a Resource with an Insecure Default

Affected products

Fixed 9 products, the same list as for CVE-2024-52316

Threats

Impact Low

References

167 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:68678	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2457025	external
https://bugzilla.redhat.com/show_bug.cgi?id=2476511	external
https://bugzilla.redhat.com/show_bug.cgi?id=2476513	external
https://bugzilla.redhat.com/show_bug.cgi?id=2476516	external
https://bugzilla.redhat.com/show_bug.cgi?id=2476519	external
https://bugzilla.redhat.com/show_bug.cgi?id=2476520	external
https://bugzilla.redhat.com/show_bug.cgi?id=2494669	external
https://bugzilla.redhat.com/show_bug.cgi?id=2499917	external
https://bugzilla.redhat.com/show_bug.cgi?id=2499931	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2024-52316	self
https://bugzilla.redhat.com/show_bug.cgi?id=2326972	external
https://www.cve.org/CVERecord?id=CVE-2024-52316	external
https://nvd.nist.gov/vuln/detail/CVE-2024-52316	external
https://lists.apache.org/thread/lopzlqh91jj9n334g…	external
https://access.redhat.com/security/cve/CVE-2024-54677	self
https://bugzilla.redhat.com/show_bug.cgi?id=2332815	external
https://www.cve.org/CVERecord?id=CVE-2024-54677	external
https://nvd.nist.gov/vuln/detail/CVE-2024-54677	external
https://lists.apache.org/thread/tdtbbxpg5trdwc2wn…	external
https://access.redhat.com/security/cve/CVE-2025-46701	self
https://bugzilla.redhat.com/show_bug.cgi?id=2369253	external
https://www.cve.org/CVERecord?id=CVE-2025-46701	external
https://nvd.nist.gov/vuln/detail/CVE-2025-46701	external
https://lists.apache.org/thread/xhqqk9w5q45srcdqh…	external
https://access.redhat.com/security/cve/CVE-2025-55668	self
https://bugzilla.redhat.com/show_bug.cgi?id=2388226	external
https://www.cve.org/CVERecord?id=CVE-2025-55668	external
https://nvd.nist.gov/vuln/detail/CVE-2025-55668	external
https://github.com/apache/tomcat/commit/8621e4c6b…	external
https://github.com/apache/tomcat/commit/90306d971…	external
https://github.com/apache/tomcat/commit/9c3673ba0…	external
https://lists.apache.org/thread/v6bknr96rl7l1qxkl…	external
https://access.redhat.com/security/cve/CVE-2025-55754	self
https://bugzilla.redhat.com/show_bug.cgi?id=2406590	external
https://www.cve.org/CVERecord?id=CVE-2025-55754	external
https://nvd.nist.gov/vuln/detail/CVE-2025-55754	external
https://github.com/apache/tomcat/commit/5a3db0929…	external
https://lists.apache.org/thread/j7w54hqbkfcn0xb9x…	external
https://access.redhat.com/security/cve/CVE-2025-61795	self
https://bugzilla.redhat.com/show_bug.cgi?id=2406588	external
https://www.cve.org/CVERecord?id=CVE-2025-61795	external
https://nvd.nist.gov/vuln/detail/CVE-2025-61795	external
https://github.com/apache/tomcat/commit/1cdf5f730…	external
https://lists.apache.org/thread/wm9mx8brmx9g4zpyw…	external
https://access.redhat.com/security/cve/CVE-2025-66614	self
https://bugzilla.redhat.com/show_bug.cgi?id=2440430	external
https://www.cve.org/CVERecord?id=CVE-2025-66614	external
https://nvd.nist.gov/vuln/detail/CVE-2025-66614	external
https://lists.apache.org/thread/vw6lxtlh2qbqwpb61…	external
https://access.redhat.com/security/cve/CVE-2026-24733	self
https://bugzilla.redhat.com/show_bug.cgi?id=2440437	external
https://www.cve.org/CVERecord?id=CVE-2026-24733	external
https://nvd.nist.gov/vuln/detail/CVE-2026-24733	external
https://lists.apache.org/thread/6xk3t65qpn1myp618…	external
https://access.redhat.com/security/cve/CVE-2026-24880	self
https://bugzilla.redhat.com/show_bug.cgi?id=2457040	external
https://www.cve.org/CVERecord?id=CVE-2026-24880	external
https://nvd.nist.gov/vuln/detail/CVE-2026-24880	external
https://lists.apache.org/thread/2c682qnlg2tv4o5kn…	external
https://access.redhat.com/security/cve/CVE-2026-25854	self
https://bugzilla.redhat.com/show_bug.cgi?id=2457039	external
https://www.cve.org/CVERecord?id=CVE-2026-25854	external
https://nvd.nist.gov/vuln/detail/CVE-2026-25854	external
https://lists.apache.org/thread/ghct3b6o74bp2vm7q…	external
https://access.redhat.com/security/cve/CVE-2026-29145	self
https://bugzilla.redhat.com/show_bug.cgi?id=2457037	external
https://www.cve.org/CVERecord?id=CVE-2026-29145	external
https://nvd.nist.gov/vuln/detail/CVE-2026-29145	external
https://lists.apache.org/thread/yz5fxmhd2j43wgqyk…	external
https://access.redhat.com/security/cve/CVE-2026-32990	self
https://bugzilla.redhat.com/show_bug.cgi?id=2457025	external
https://www.cve.org/CVERecord?id=CVE-2026-32990	external
https://nvd.nist.gov/vuln/detail/CVE-2026-32990	external
https://lists.apache.org/thread/1nl9zqft0ksqlhlkd…	external
https://access.redhat.com/security/cve/CVE-2026-34483	self
https://bugzilla.redhat.com/show_bug.cgi?id=2457044	external
https://www.cve.org/CVERecord?id=CVE-2026-34483	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34483	external
https://lists.apache.org/thread/j1w7304yonlr8vo1t…	external
https://access.redhat.com/security/cve/CVE-2026-34487	self
https://bugzilla.redhat.com/show_bug.cgi?id=2457038	external
https://www.cve.org/CVERecord?id=CVE-2026-34487	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34487	external
https://lists.apache.org/thread/4xpkwolpkrj8v5xzp…	external
https://access.redhat.com/security/cve/CVE-2026-41284	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476518	external
https://www.cve.org/CVERecord?id=CVE-2026-41284	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41284	external
https://lists.apache.org/thread/2nvqjr7ovjmvx2vbh…	external
https://access.redhat.com/security/cve/CVE-2026-41293	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476513	external
https://www.cve.org/CVERecord?id=CVE-2026-41293	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41293	external
https://lists.apache.org/thread/qwg0q16z7xkb2qrr8…	external
https://access.redhat.com/security/cve/CVE-2026-42498	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476516	external
https://www.cve.org/CVERecord?id=CVE-2026-42498	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42498	external
https://lists.apache.org/thread/n61zwf75jrv09rz90…	external
https://access.redhat.com/security/cve/CVE-2026-43512	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476511	external
https://www.cve.org/CVERecord?id=CVE-2026-43512	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43512	external
https://lists.apache.org/thread/7x09x7o12solvclsl…	external
https://access.redhat.com/security/cve/CVE-2026-43513	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476520	external
https://www.cve.org/CVERecord?id=CVE-2026-43513	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43513	external
https://lists.apache.org/thread/ytjcgldshj73lcnd1…	external
https://access.redhat.com/security/cve/CVE-2026-43514	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476512	external
https://www.cve.org/CVERecord?id=CVE-2026-43514	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43514	external
https://lists.apache.org/thread/2k654v5cq123npfsd…	external
https://access.redhat.com/security/cve/CVE-2026-43515	self
https://bugzilla.redhat.com/show_bug.cgi?id=2476519	external
https://www.cve.org/CVERecord?id=CVE-2026-43515	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43515	external
https://lists.apache.org/thread/746nxfxod0wsocxtm…	external
https://access.redhat.com/security/cve/CVE-2026-50229	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494688	external
https://www.cve.org/CVERecord?id=CVE-2026-50229	external
https://nvd.nist.gov/vuln/detail/CVE-2026-50229	external
https://lists.apache.org/thread/wlt2no8bw45zl1w8b…	external
https://access.redhat.com/security/cve/CVE-2026-53404	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494681	external
https://www.cve.org/CVERecord?id=CVE-2026-53404	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53404	external
https://lists.apache.org/thread/rdhpghgfskrdmw9hq…	external
https://access.redhat.com/security/cve/CVE-2026-53434	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494668	external
https://www.cve.org/CVERecord?id=CVE-2026-53434	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53434	external
https://lists.apache.org/thread/x510lbq0sfrd1qyo7…	external
https://access.redhat.com/security/cve/CVE-2026-55276	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494675	external
https://www.cve.org/CVERecord?id=CVE-2026-55276	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55276	external
https://lists.apache.org/thread/jy09xjlzn6r2qwvqo…	external
https://access.redhat.com/security/cve/CVE-2026-55955	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494678	external
https://www.cve.org/CVERecord?id=CVE-2026-55955	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55955	external
https://lists.apache.org/thread/g4p5sf45p3f9r011p…	external
https://access.redhat.com/security/cve/CVE-2026-55956	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494676	external
https://www.cve.org/CVERecord?id=CVE-2026-55956	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55956	external
https://lists.apache.org/thread/dcjdcnnnww9hhdm01…	external
https://access.redhat.com/security/cve/CVE-2026-55957	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494669	external
https://www.cve.org/CVERecord?id=CVE-2026-55957	external
https://nvd.nist.gov/vuln/detail/CVE-2026-55957	external
https://lists.apache.org/thread/7fk339o5jvd4mcgsf…	external
https://access.redhat.com/security/cve/CVE-2026-59083	self
https://bugzilla.redhat.com/show_bug.cgi?id=2499917	external
https://www.cve.org/CVERecord?id=CVE-2026-59083	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59083	external
https://lists.apache.org/thread/3g63zos2gkjo5vgnr…	external
https://access.redhat.com/security/cve/CVE-2026-59084	self
https://bugzilla.redhat.com/show_bug.cgi?id=2499931	external
https://www.cve.org/CVERecord?id=CVE-2026-59084	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59084	external
https://lists.apache.org/thread/7w9746ootcxo0gvx2…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for tomcat is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n\n* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n\n* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n\n* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n\n* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n\n* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n\n* tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)\n\n* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n\n* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:68678",
        "url": "https://access.redhat.com/errata/RHSA-2026:68678"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2457025",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457025"
      },
      {
        "category": "external",
        "summary": "2476511",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476511"
      },
      {
        "category": "external",
        "summary": "2476513",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476513"
      },
      {
        "category": "external",
        "summary": "2476516",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476516"
      },
      {
        "category": "external",
        "summary": "2476519",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476519"
      },
      {
        "category": "external",
        "summary": "2476520",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476520"
      },
      {
        "category": "external",
        "summary": "2494669",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494669"
      },
      {
        "category": "external",
        "summary": "2499917",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499917"
      },
      {
        "category": "external",
        "summary": "2499931",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499931"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68678.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat security update",
    "tracking": {
      "current_release_date": "2026-09-25T15:32:13+00:00",
      "generator": {
        "date": "2026-09-25T15:32:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:68678",
      "initial_release_date": "2026-09-17T15:08:22+00:00",
      "revision_history": [
        {
          "date": "2026-09-17T15:08:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-17T15:08:22+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-25T15:32:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
                  "product_id": "AppStream-9.2.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_e4s:9.2::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-1:9.0.120-1.el9_2.noarch",
                "product": {
                  "name": "tomcat-1:9.0.120-1.el9_2.noarch",
                  "product_id": "tomcat-1:9.0.120-1.el9_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat@9.0.120-1.el9_2?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
                "product": {
                  "name": "tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
                  "product_id": "tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-admin-webapps@9.0.120-1.el9_2?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
                "product": {
                  "name": "tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
                  "product_id": "tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-docs-webapp@9.0.120-1.el9_2?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
                "product": {
                  "name": "tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
                  "product_id": "tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-el-3.0-api@9.0.120-1.el9_2?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
                "product": {
                  "name": "tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
                  "product_id": "tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-jsp-2.3-api@9.0.120-1.el9_2?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-1:9.0.120-1.el9_2.noarch",
                "product": {
                  "name": "tomcat-lib-1:9.0.120-1.el9_2.noarch",
                  "product_id": "tomcat-lib-1:9.0.120-1.el9_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-lib@9.0.120-1.el9_2?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
                "product": {
                  "name": "tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
                  "product_id": "tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-servlet-4.0-api@9.0.120-1.el9_2?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-1:9.0.120-1.el9_2.noarch",
                "product": {
                  "name": "tomcat-webapps-1:9.0.120-1.el9_2.noarch",
                  "product_id": "tomcat-webapps-1:9.0.120-1.el9_2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-webapps@9.0.120-1.el9_2?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-1:9.0.120-1.el9_2.src",
                "product": {
                  "name": "tomcat-1:9.0.120-1.el9_2.src",
                  "product_id": "tomcat-1:9.0.120-1.el9_2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat@9.0.120-1.el9_2?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-1:9.0.120-1.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch"
        },
        "product_reference": "tomcat-1:9.0.120-1.el9_2.noarch",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-1:9.0.120-1.el9_2.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src"
        },
        "product_reference": "tomcat-1:9.0.120-1.el9_2.src",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch"
        },
        "product_reference": "tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch"
        },
        "product_reference": "tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch"
        },
        "product_reference": "tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch"
        },
        "product_reference": "tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-1:9.0.120-1.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch"
        },
        "product_reference": "tomcat-lib-1:9.0.120-1.el9_2.noarch",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch"
        },
        "product_reference": "tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-1:9.0.120-1.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        },
        "product_reference": "tomcat-webapps-1:9.0.120-1.el9_2.noarch",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-52316",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2024-11-18T12:00:54.223330+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2326972"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat when configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component. This vulnerability allows authentication bypass via improperly handled exceptions during the authentication process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has assessed this flaw at Attack Complexity as High, and impact metrics Confidentiality and Integrity as High, with a resultant base flaw Security Impact of Important. However, the factors involved in successful exploitation--usage of a custom Jakarta ServerAuthContext component, possible mishandling of exception management in that custom component, and failure in such a way as to allow a failed authentication to proceed in that exception mishandling--are sufficiently unlikely, such that Apache determined the impact to be Low. While Red Hat concurs with the worst-case assessment of Important for the base flaw, all products are assessed as Low, per individual risk assessment and in concurrence with Apache\u0027s rating.\n\nRed Hat Satellite is not directly impacted by this issue as it does not include the affected Tomcat package. However, Tomcat is consumed by Candlepin, a component of Satellite. Red Hat Satellite users are advised to check the impact state of Red Hat Enterprise Linux as any necessary fixes will be distributed through the platform.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-52316"
        },
        {
          "category": "external",
          "summary": "RHBZ#2326972",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2326972"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-52316",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-52316"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-52316",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52316"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928",
          "url": "https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928"
        }
      ],
      "release_date": "2024-11-18T11:32:22.072000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API"
    },
    {
      "cve": "CVE-2024-54677",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-12-17T13:00:41.984822+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2332815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the \"examples\" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory (OOM) error, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: DoS in examples web application",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "By default, the examples web application is only accessible to the localhost.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-54677"
        },
        {
          "category": "external",
          "summary": "RHBZ#2332815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-54677",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-54677"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-54677",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54677"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n",
          "url": "https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n"
        }
      ],
      "release_date": "2024-12-17T12:35:50.948000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: DoS in examples web application"
    },
    {
      "cve": "CVE-2025-46701",
      "cwe": {
        "id": "CWE-178",
        "name": "Improper Handling of Case Sensitivity"
      },
      "discovery_date": "2025-05-29T20:00:51.512562+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2369253"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the CGI servlet component of Apache Tomcat. This vulnerability allows a security constraint bypass via improper handling of case sensitivity in the pathInfo component of a URI mapped to the CGI servlet.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Security constraint bypass for CGI scripts",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate rather than Important due to several limiting technical factors that reduce its overall impact and exploitability. Firstly, the flaw only manifests on case-insensitive file systems (e.g., Windows NTFS or macOS HFS+), which are less common in production-grade Tomcat deployments, most of which run on case-sensitive Linux file systems. Secondly, the bypass only occurs when security constraints are defined specifically on the pathInfo portion of URLs mapped to the CGI servlet \u2014 a relatively uncommon and niche configuration in modern Tomcat-based applications, where URL-based access control tends to use more direct patterns or broader filters. Additionally, successful exploitation does not lead to remote code execution or denial of service, but rather circumvents access control under specific conditions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-46701"
        },
        {
          "category": "external",
          "summary": "RHBZ#2369253",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369253"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-46701",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-46701"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j",
          "url": "https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j"
        }
      ],
      "release_date": "2025-05-29T19:06:04.289000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: Security constraint bypass for CGI scripts"
    },
    {
      "cve": "CVE-2025-55668",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "discovery_date": "2025-08-13T14:00:45.674371+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2388226"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will occur within the context of the attacker\u0027s session. This could allow an attacker to hijack the victim\u0027s session and perform actions on their behalf.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-55668"
        },
        {
          "category": "external",
          "summary": "RHBZ#2388226",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388226"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-55668",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-55668"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-55668",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55668"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6",
          "url": "https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21",
          "url": "https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95",
          "url": "https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47",
          "url": "https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47"
        }
      ],
      "release_date": "2025-08-13T13:21:35.743000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve"
    },
    {
      "cve": "CVE-2025-55754",
      "cwe": {
        "id": "CWE-150",
        "name": "Improper Neutralization of Escape, Meta, or Control Sequences"
      },
      "discovery_date": "2025-10-27T18:01:17.953987+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2406590"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An improper input neutralization flaw has been discovered in Apache Tomcat. \nTomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-55754"
        },
        {
          "category": "external",
          "summary": "RHBZ#2406590",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406590"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-55754",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-55754"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-55754",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55754"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/5a3db092982c0c58d4855304167ee757fe5e79bb",
          "url": "https://github.com/apache/tomcat/commit/5a3db092982c0c58d4855304167ee757fe5e79bb"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd",
          "url": "https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd"
        }
      ],
      "release_date": "2025-10-27T17:29:50.756000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation"
    },
    {
      "cve": "CVE-2025-61795",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "discovery_date": "2025-10-27T18:01:06.418669+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2406588"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw has been discovered in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61795"
        },
        {
          "category": "external",
          "summary": "RHBZ#2406588",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406588"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61795",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61795"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06",
          "url": "https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp",
          "url": "https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp"
        }
      ],
      "release_date": "2025-10-27T17:30:28.334000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service"
    },
    {
      "cve": "CVE-2025-66614",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-02-17T20:04:14.943661+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2440430"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field. The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Client certificate verification bypass due to virtual host mapping",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66614"
        },
        {
          "category": "external",
          "summary": "RHBZ#2440430",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440430"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66614",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66614"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66614",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66614"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7",
          "url": "https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7"
        }
      ],
      "release_date": "2026-02-17T18:48:30.577000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Client certificate verification bypass due to virtual host mapping"
    },
    {
      "cve": "CVE-2026-24733",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2026-02-17T20:05:04.953085+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2440437"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0.9 protocol can bypass the intended denial rule, enabling an attacker to access resources that should be protected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: security constraint bypass with HTTP/0.9",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is only exploitable when Tomcat is configured to allow HEAD requests but deny GET requests to the same resource, a very unlikely configuration. Due to this reason, this flaw has been rated with a low severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-24733"
        },
        {
          "category": "external",
          "summary": "RHBZ#2440437",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440437"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-24733",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24733"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24733",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24733"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f",
          "url": "https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f"
        }
      ],
      "release_date": "2026-02-17T18:50:43.871000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, ensure that security constraints are consistent across similar methods (e.g., if GET is denied, HEAD should likely be denied) or block HTTP/0.9 traffic via a reverse proxy or firewall, if it is not required.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: security constraint bypass with HTTP/0.9"
    },
    {
      "cve": "CVE-2026-24880",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-04-09T20:02:12.819168+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457040"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP requests are processed, potentially leading to the bypassing of security controls, cache poisoning, or other malicious activities.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability has a Low impact. A flaw in Apache Tomcat allows for HTTP Request/Response Smuggling through invalid chunk extensions. This could enable a remote attacker to bypass security controls or poison caches by manipulating HTTP request processing. This affects Red Hat Enterprise Linux and Red Hat JBoss Web Server.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-24880"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457040",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457040"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-24880",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24880"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24880",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24880"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn",
          "url": "https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn"
        }
      ],
      "release_date": "2026-04-09T19:12:10.730000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension"
    },
    {
      "cve": "CVE-2026-25854",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "discovery_date": "2026-04-09T20:02:10.027820+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457039"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This open redirect vulnerability allows an attacker to redirect a user to an untrusted site. This occurs through the LoadBalancerDrainingValve, which can be exploited to manipulate URL redirection. The primary impact is that users may be unknowingly directed to malicious websites, potentially leading to phishing attacks or other security compromises.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Low impact vulnerability in Apache Tomcat allows for an open redirect through the LoadBalancerDrainingValve. An attacker could exploit this to redirect users to malicious websites, potentially leading to phishing. This affects Red Hat Enterprise Linux and Red Hat JBoss Web Server when Apache Tomcat is configured with the LoadBalancerDrainingValve.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25854"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457039",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457039"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25854",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25854"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25854",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25854"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0",
          "url": "https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0"
        }
      ],
      "release_date": "2026-04-09T19:13:13.529000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, disable or remove the LoadBalancerDrainingValve configuration from the server.xml file in your Apache Tomcat installation. This valve is typically configured within a \u003cHost\u003e or \u003cEngine\u003e element. After modifying server.xml, restart the Apache Tomcat service for the changes to take effect. This action may impact load balancing functionality if the valve is actively used for draining connections.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve"
    },
    {
      "cve": "CVE-2026-29145",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-04-09T20:02:03.334498+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457037"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat and Apache Tomcat Native. When CLIENT_CERT authentication is configured with \"soft fail\" disabled, the authentication process may not correctly fail in certain scenarios. This vulnerability could allow an attacker to bypass expected client certificate authentication, potentially leading to unauthorized access to protected resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate vulnerability in Apache Tomcat and Apache Tomcat Native arises when CLIENT_CERT authentication is configured with \"soft fail\" disabled. This misconfiguration can lead to an authentication bypass, potentially allowing unauthorized access to protected resources. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10, along with Red Hat JBoss Web Server 5 and 6, are affected if running Apache Tomcat with this specific configuration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29145"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457037",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457037"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29145"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29145",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29145"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz",
          "url": "https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz"
        }
      ],
      "release_date": "2026-04-09T19:20:24.601000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that CLIENT_CERT authentication is configured to strictly enforce client certificate validation. Review the Apache Tomcat conf/server.xml configuration. For SSLHostConfig or Connector elements, set the clientAuth attribute to required or ensure softFail is enabled if optional client certificate authentication is desired. A restart of the Apache Tomcat service is necessary for these configuration changes to apply.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration"
    },
    {
      "cve": "CVE-2026-32990",
      "cwe": {
        "id": "CWE-184",
        "name": "Incomplete List of Disallowed Inputs"
      },
      "discovery_date": "2026-04-09T20:01:19.299996+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457025"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue (CVE-2025-66614). This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact. This improper input validation vulnerability in Apache Tomcat, stemming from an incomplete fix for CVE-2025-66614, affects Red Hat JBoss Web Server and Red Hat Enterprise Linux. An attacker could exploit this flaw to bypass security controls or induce unexpected application behavior.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32990"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457025",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457025"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32990",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32990"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32990",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32990"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7",
          "url": "https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7"
        }
      ],
      "release_date": "2026-04-09T19:23:49.618000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix"
    },
    {
      "cve": "CVE-2026-34483",
      "cwe": {
        "id": "CWE-838",
        "name": "Inappropriate Encoding for Output Context"
      },
      "discovery_date": "2026-04-09T20:02:26.870249+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457044"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the JsonAccessLogValve component of Apache Tomcat. This improper encoding or escaping of output vulnerability could allow an attacker to inject specially crafted data into log files. This could lead to information disclosure or other unintended consequences when the logs are processed or viewed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Low impact. A flaw in the Apache Tomcat JsonAccessLogValve component allows for improper encoding of output. This could enable an attacker to inject specially crafted data into log files, potentially leading to information disclosure or other unintended consequences during log processing. This affects Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34483"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457044",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457044"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34483",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34483"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34483",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34483"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b",
          "url": "https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b"
        }
      ],
      "release_date": "2026-04-09T19:30:28.874000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve"
    },
    {
      "cve": "CVE-2026-34487",
      "cwe": {
        "id": "CWE-538",
        "name": "Insertion of Sensitive Information into Externally-Accessible File or Directory"
      },
      "discovery_date": "2026-04-09T20:02:06.944382+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457038"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. The cloud membership for clustering component was vulnerable to the insertion of sensitive information into log files. This vulnerability could lead to the exposure of the Kubernetes bearer token, which is a credential used for authentication within a Kubernetes cluster, potentially allowing unauthorized access to cluster resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Low impact. This vulnerability in Apache Tomcat affects the cloud membership for clustering component, potentially exposing Kubernetes bearer tokens in log files. Exploitation requires the cloud membership feature to be enabled and an attacker to have access to the system\u0027s log files. Red Hat Enterprise Linux versions are affected if running Apache Tomcat with this specific clustering configuration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34487"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457038",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457038"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34487",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34487"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34487",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34487"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h",
          "url": "https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h"
        }
      ],
      "release_date": "2026-04-09T19:36:12.048000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "Disable the cloud membership for clustering feature in Apache Tomcat if it is not actively used. Additionally, ensure that access to Apache Tomcat log files is strictly controlled and limited to authorized personnel only to prevent unauthorized disclosure of sensitive information. If the cloud membership for clustering feature is disabled, a restart of the Apache Tomcat service may be required for the changes to take effect.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files"
    },
    {
      "cve": "CVE-2026-41284",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-12T16:01:43.841831+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476518"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service (DoS), making the affected system unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41284"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476518",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476518"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41284",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41284"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc",
          "url": "https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc"
        }
      ],
      "release_date": "2026-05-12T15:14:45.278000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation"
    },
    {
      "cve": "CVE-2026-41293",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-05-12T16:01:31.003990+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476513"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41293"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476513",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476513"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41293",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41293"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41293",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41293"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r",
          "url": "https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r"
        }
      ],
      "release_date": "2026-05-12T15:19:35.179000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated"
    },
    {
      "cve": "CVE-2026-42498",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-05-12T16:01:38.872167+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476516"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42498"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476516",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476516"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42498",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42498"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42498",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42498"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb",
          "url": "https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb"
        }
      ],
      "release_date": "2026-05-12T15:17:56.531000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication."
    },
    {
      "cve": "CVE-2026-43512",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-05-12T16:01:26.008892+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476511"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password \"null\". This allows a remote attacker to bypass security controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Apache Tomcat allows an authentication bypass when DIGEST authentication is configured. An attacker can authenticate as any unknown user by providing the password \u0027null\u0027, potentially gaining unauthorized access to applications protected by DIGEST authentication. Red Hat products are only affected if they are configured to use DIGEST authentication, which is not a common, out of the box and expected configuration for Production environments. \n\nFurthermore, because the unknown user is not mapped to any valid realm roles, their access is still restricted by standard application authorization constraints, significantly limiting the actual impact.\n\nThe unknown user is not mapped to any existing user, which means, it does not steal credentials nor impersonate an existing user. This new user is expected to have the minimum possible authentication and authorization range within the realm inherited roles.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43512"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476511",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476511"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43512",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43512"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43512",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43512"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73",
          "url": "https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73"
        }
      ],
      "release_date": "2026-05-12T15:24:02.424000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable DIGEST authentication within Apache Tomcat if it is not essential for your environment. This involves modifying the server\u0027s authentication configuration to utilize alternative methods or remove the DIGEST realm. A service restart is required for these changes to take effect and may impact functionality relying on DIGEST authentication.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication"
    },
    {
      "cve": "CVE-2026-43513",
      "cwe": {
        "id": "CWE-178",
        "name": "Improper Handling of Case Sensitivity"
      },
      "discovery_date": "2026-05-12T16:01:48.767743+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476520"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Apache Tomcat\u0027s LockOutRealm. When configured with an underlying Realm where usernames are case-insensitive, the LockOutRealm does not account for case differences, potentially reducing the effectiveness of brute-force protection. Exploitation requires LockOutRealm to be configured with a case-insensitive authentication backend, which is a non-default configuration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43513"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476520",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476520"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43513",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43513"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp",
          "url": "https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp"
        }
      ],
      "release_date": "2026-05-12T15:26:25.599000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "This vulnerability only affects Tomcat deployments using the LockOutRealm with a case-insensitive authentication backend. Deployments not using LockOutRealm or using case-sensitive authentication backends are not affected.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm"
    },
    {
      "cve": "CVE-2026-43514",
      "cwe": {
        "id": "CWE-208",
        "name": "Observable Timing Discrepancy"
      },
      "discovery_date": "2026-05-12T16:01:28.665836+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476512"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. The AJP secret was comparable in non-constant time, allowing an attacker on the local network to mount a timing attack to determine the AJP secret, which may lead to unauthorized access or other security bypasses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43514"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476512",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476512"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43514",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43514"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43514",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43514"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m",
          "url": "https://lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m"
        }
      ],
      "release_date": "2026-05-12T15:32:09.858000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy"
    },
    {
      "cve": "CVE-2026-43515",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-05-12T16:01:46.217175+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476519"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat-coyote: tomcat: Improper Authorization allows security bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43515"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476519",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476519"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43515",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43515"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb",
          "url": "https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb"
        }
      ],
      "release_date": "2026-05-12T15:33:23.311000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass"
    },
    {
      "cve": "CVE-2026-50229",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-06-29T21:02:24.415552+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494688"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting (XSS), allows a remote attacker to inject malicious scripts into the \u0027number guess example\u0027 web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to unauthorized access to sensitive information or allow an attacker to alter the content of the website.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Apache Tomcat. A Cross-Site Scripting (XSS) vulnerability exists in the \"number guess\" example web application shipped with Tomcat. An attacker can inject malicious scripts into the example page, which execute in other users\u0027 browsers when they view the page. This vulnerability only affects the example web application, not the Tomcat servlet container itself. Red Hat Tomcat packages do not deploy example applications by default \u2014 they are in separate optional packages (e.g., tomcat-webapps) that are not installed in production environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50229"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494688",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494688"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50229",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50229"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50229",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50229"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0",
          "url": "https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0"
        }
      ],
      "release_date": "2026-06-29T20:36:24.683000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "Remove or disable the Tomcat example web applications if they are deployed. Example applications are not needed for production use and should not be accessible in production environments.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example"
    },
    {
      "cve": "CVE-2026-53404",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-06-29T21:01:58.363486+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494681"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat\u0027s rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended rule processing, potentially allowing for security bypasses or unauthorized access due to misapplied configurations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Apache Tomcat\u0027s RewriteValve. When rewrite rules use OR-chained conditions followed by non-OR conditions, the processing logic may not evaluate conditions correctly, potentially allowing unintended rule matches. Exploitation requires the RewriteValve to be enabled with specific OR-chained condition patterns, which is not a default configuration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-53404"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494681",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494681"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-53404",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53404"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53404",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53404"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz",
          "url": "https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz"
        }
      ],
      "release_date": "2026-06-29T20:39:45.317000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "This vulnerability only affects Tomcat deployments that use the RewriteValve with OR-chained rewrite conditions. Deployments that do not use the RewriteValve are not affected. Review rewrite rules for OR-chained conditions and test rule evaluation behavior.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing"
    },
    {
      "cve": "CVE-2026-53434",
      "cwe": {
        "id": "CWE-390",
        "name": "Detection of Error Condition Without Action"
      },
      "discovery_date": "2026-06-29T21:01:05.687650+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494668"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists (CRLs) for a FFM (presumably a specific type of connector), the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security controls might not be properly enforced.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Error condition not handled when configuring CRLs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Apache Tomcat. When using the FFM-based connector with CRL-based certificate revocation checking, an error in CRL data processing is not handled correctly, potentially allowing revoked certificates to be accepted. This only affects Tomcat 10.1.0-M7+ and 11.x using the FFM connector (Java 22+ Foreign Function \u0026 Memory API) with CRL configuration \u2014 an extremely narrow set of conditions not present in standard Red Hat deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-53434"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494668",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494668"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-53434",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53434"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53434",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53434"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk",
          "url": "https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk"
        }
      ],
      "release_date": "2026-06-29T20:41:06.948000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "This vulnerability only affects Tomcat deployments using the FFM-based connector (requires Java 22+) with CRL-based certificate revocation checking. Deployments using the standard NIO/NIO2 connectors or not using CRL checking are not affected.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Error condition not handled when configuring CRLs"
    },
    {
      "cve": "CVE-2026-55276",
      "cwe": {
        "id": "CWE-778",
        "name": "Insufficient Logging"
      },
      "discovery_date": "2026-06-29T21:01:38.615799+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494675"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might misinterpret the actual authorization constraints, potentially impacting the security posture of the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Apache Tomcat. When the effective web.xml logging feature is enabled for debugging, special roles and empty authorization constraints may be omitted from the logged output. This is a logging-only issue with no runtime security impact \u2014 it only affects the accuracy of debug log output for administrators reviewing the effective web.xml configuration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55276"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494675",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494675"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55276",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55276"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55276",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55276"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v",
          "url": "https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v"
        }
      ],
      "release_date": "2026-06-29T20:42:23.257000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "This is a logging-only issue with no runtime security impact. No mitigation is required. Administrators should not rely solely on the effective web.xml debug log output to verify security constraint configuration.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow"
    },
    {
      "cve": "CVE-2026-55955",
      "cwe": {
        "id": "CWE-294",
        "name": "Authentication Bypass by Capture-replay"
      },
      "discovery_date": "2026-06-29T21:01:48.701284+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494678"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Apache Tomcat\u0027s EncryptionInterceptor used for Tribes cluster communication. An improper authentication vulnerability allows a replay attack against encrypted cluster messages. Exploitation requires the EncryptionInterceptor to be configured for Tomcat clustering, which is a non-default configuration, and the attacker must have access to the cluster network to capture and replay messages. Apache rates this vulnerability as Low severity. Red Hat has corrected the impact from IMPORTANT to MODERATE \u2014 the original AI-Bot CVSS of 8.2 (AV:N/AC:L) incorrectly scored this as internet-facing with low complexity, when Tribes cluster traffic is adjacent-network (AV:A) and requires non-default clustering configuration (AC:H). The corrected vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.2).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55955"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494678",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494678"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55955",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55955"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55955",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55955"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106",
          "url": "https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106"
        }
      ],
      "release_date": "2026-06-29T20:44:39.779000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "This vulnerability only affects Tomcat deployments using the EncryptionInterceptor for Tribes cluster communication. Deployments that do not use Tomcat clustering or do not configure the EncryptionInterceptor are not affected. Ensure cluster communication channels are restricted to trusted, isolated networks.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor"
    },
    {
      "cve": "CVE-2026-55956",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-06-29T21:01:42.101197+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494676"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A security flaw in Apache Tomcat allows an attacker to bypass specific HTTP method restrictions on the default servlet. Red Hat products utilizing affected Tomcat versions are vulnerable if they rely on these method-specific security constraints. This could potentially enable unauthorized access to restricted application resources.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55956"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494676",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494676"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55956",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55956"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55956",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55956"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp",
          "url": "https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp"
        }
      ],
      "release_date": "2026-06-29T20:46:02.927000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "Review your application\u0027s web.xml file. Ensure security constraints explicitly deny unauthorized users by path, rather than relying strictly on filtering specific HTTP methods (like GET or POST).",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass"
    },
    {
      "cve": "CVE-2026-55957",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "discovery_date": "2026-06-29T21:01:13.605887+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494669"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct password, leading to unauthorized access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated as Important severity because it allows an attacker to fully bypass password verification when authenticating against a Tomcat instance, potentially gaining unauthorized access to protected resources without any privileges or user interaction required.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55957"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494669",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494669"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55957",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55957"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55957",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55957"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh",
          "url": "https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh"
        }
      ],
      "release_date": "2026-06-29T20:47:12.661000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration"
    },
    {
      "cve": "CVE-2026-59083",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-07-14T09:01:06.476183+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499917"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding (hex encoding). A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actions that should be restricted.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Low impact vulnerability in Apache Tomcat\u0027s rewrite valve allows a security constraint bypass through improper URL encoding. Exploitation requires specific configurations and has high attack complexity, limiting its overall risk to Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59083"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499917",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499917"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59083",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59083"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59083",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59083"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq",
          "url": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq"
        }
      ],
      "release_date": "2026-07-14T08:13:04.861000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, review Apache Tomcat\u0027s rewrite valve configurations. If the rewrite valve is not essential for your application, consider disabling it. If it is required, ensure its configuration does not permit improper URL encoding that could lead to security constraint bypasses. A service restart may be required for changes to take effect.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve"
    },
    {
      "cve": "CVE-2026-59084",
      "cwe": {
        "id": "CWE-1188",
        "name": "Initialization of a Resource with an Insecure Default"
      },
      "discovery_date": "2026-07-14T10:01:17.476740+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499931"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance, potentially compromising the confidentiality or integrity of data processed by the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Low impact vulnerability in Apache Tomcat arises from insufficient documentation for the EncryptInterceptor. Without clear guidance on secure configuration, administrators might inadvertently deploy the interceptor in a way that weakens security, rather than a direct code flaw. This issue affects Red Hat products utilizing Apache Tomcat, including Red Hat Enterprise Linux and Red Hat JBoss Web Server.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
          "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
          "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59084"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499931",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499931"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59084",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59084"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59084",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59084"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7",
          "url": "https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7"
        }
      ],
      "release_date": "2026-07-14T08:24:21.531000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:08:22+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68678"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that the EncryptInterceptor in Apache Tomcat is configured according to secure best practices. Review existing configurations of EncryptInterceptor to verify that all security requirements are met and that no insecure settings are in place. If the EncryptInterceptor is not actively used, no specific action is required.",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-1:9.0.120-1.el9_2.src",
            "AppStream-9.2.0.Z.E4S:tomcat-admin-webapps-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-docs-webapp-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-el-3.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-jsp-2.3-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-lib-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-servlet-4.0-api-1:9.0.120-1.el9_2.noarch",
            "AppStream-9.2.0.Z.E4S:tomcat-webapps-1:9.0.120-1.el9_2.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations"
    }
  ]
}

CVE-2026-43515 (GCVE-0-2026-43515)

Vulnerability from cvelistv5 – Published: 2026-05-12 15:33 – Updated: 2026-06-04 09:57

Title

Apache Tomcat: Security constraints not correctly applied

Summary

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-14 16:33 UTC

CWE

CWE-285 - Improper Authorization

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/746nxfxod0wsocxtm…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.21 (semver) Affected: 10.1.0-M1 , ≤ 10.1.54 (semver) Affected: 9.0.0.M1 , ≤ 9.0.117 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Affected: 7.0.0 , ≤ 7.0.109 (semver) Unknown: 0 , < 7.0.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-12T17:41:02.585Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/12/11"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-43515",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T16:33:57.706160Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T19:53:24.668Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.21",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.54",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.117",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T09:57:54.826Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Security constraints not correctly applied",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-43515",
    "datePublished": "2026-05-12T15:33:23.311Z",
    "dateReserved": "2026-05-01T16:24:01.021Z",
    "dateUpdated": "2026-06-04T09:57:54.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-50229 (GCVE-0-2026-50229)

Vulnerability from cvelistv5 – Published: 2026-06-29 20:36 – Updated: 2026-06-30 12:50

Title

Apache Tomcat: XSS in number guess example

Summary

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 12:49 UTC

CWE

CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/wlt2no8bw45zl1w8b…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.22 (semver) Affected: 10.1.0-M1 , ≤ 10.1.55 (semver) Affected: 9.0.0.M1 , ≤ 9.0.118 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Affected: 7.0.0 , ≤ 7.0.109 (semver) Unknown: 0 , < 7.0.0 (semver)

Credits

Erichen, Institute of Computing Technology, Chinese Academy of Sciences Yashar Shahinzadeh Amirmohammad Safari

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-29T22:24:20.838Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/29/20"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-50229",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T12:49:25.834984Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T12:50:01.539Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.22",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.55",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.118",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Erichen, Institute of Computing Technology, Chinese Academy of Sciences"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Yashar Shahinzadeh"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Amirmohammad Safari"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T20:37:30.642Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: XSS in number guess example",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-50229",
    "datePublished": "2026-06-29T20:36:24.683Z",
    "dateReserved": "2026-06-04T09:39:23.609Z",
    "dateUpdated": "2026-06-30T12:50:01.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53404 (GCVE-0-2026-53404)

Vulnerability from cvelistv5 – Published: 2026-06-29 20:39 – Updated: 2026-06-30 12:34

Title

Apache Tomcat: Bad ornext processing in RewriteValve

Summary

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 12:30 UTC

CWE

CWE-670 - Always-Incorrect Control Flow Implementation

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/rdhpghgfskrdmw9hq…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.22 (semver) Affected: 10.1.0-M1 , ≤ 10.1.55 (semver) Affected: 9.0.0.M1 , ≤ 9.0.118 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Unaffected: 0 , < 8.0.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-29T22:24:25.256Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/29/21"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-53404",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T12:30:42.750259Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T12:34:20.821Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.22",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.55",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.118",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.0.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAlways-Incorrect Control Flow Implementation vulnerability in Apache Tomcat\u0027s rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat\u0027s rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670 Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T20:39:45.317Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Apache Tomcat: Bad ornext processing in RewriteValve",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-53404",
    "datePublished": "2026-06-29T20:39:45.317Z",
    "dateReserved": "2026-06-09T08:52:02.309Z",
    "dateUpdated": "2026-06-30T12:34:20.821Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53434 (GCVE-0-2026-53434)

Vulnerability from cvelistv5 – Published: 2026-06-29 20:41 – Updated: 2026-06-30 12:28

Title

Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

Summary

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 12:28 UTC

CWE

CWE-390 - Detection of Error Condition Without Action

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/x510lbq0sfrd1qyo7…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.22 (semver) Affected: 10.1.0-M7 , ≤ 10.1.55 (semver) Affected: 9.0.83 , ≤ 9.0.118 (semver) Unaffected: 0 , ≤ 9.0.82 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-29T22:24:26.203Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/29/22"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-53434",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T12:28:14.286092Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T12:28:36.391Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.22",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.55",
              "status": "affected",
              "version": "10.1.0-M7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.118",
              "status": "affected",
              "version": "9.0.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.82",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDetection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-390",
              "description": "CWE-390 Detection of Error Condition Without Action",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T20:41:06.948Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Invalid CRL configuration doesn\u0027t trigger failure for FFM Connector",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-53434",
    "datePublished": "2026-06-29T20:41:06.948Z",
    "dateReserved": "2026-06-09T14:08:56.764Z",
    "dateUpdated": "2026-06-30T12:28:36.391Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55276 (GCVE-0-2026-55276)

Vulnerability from cvelistv5 – Published: 2026-06-29 20:42 – Updated: 2026-06-30 13:59

Title

Apache Tomcat: Logged effective web.xml is incomplete

Summary

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 13:59 UTC

CWE

CWE-670 - Always-Incorrect Control Flow Implementation

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/jy09xjlzn6r2qwvqo…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.22 (semver) Affected: 10.1.0-M1 , ≤ 10.1.55 (semver) Affected: 9.0.0.M1 , ≤ 9.0.118 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Unaffected: 0 , < 8.0.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-29T22:24:32.168Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/29/23"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-55276",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:59:26.729885Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:59:37.872Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.22",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.55",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.118",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.0.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAlways-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100.\u0026nbsp;Other versions that have reached end of support may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100.\u00a0Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670 Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T20:42:23.257Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Logged effective web.xml is incomplete",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-55276",
    "datePublished": "2026-06-29T20:42:23.257Z",
    "dateReserved": "2026-06-16T17:40:51.153Z",
    "dateUpdated": "2026-06-30T13:59:37.872Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55955 (GCVE-0-2026-55955)

Vulnerability from cvelistv5 – Published: 2026-06-29 20:44 – Updated: 2026-06-30 13:22

Title

Apache Tomcat: EncryptInterceptor not protected against replay attacks

Summary

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 13:21 UTC

CWE

CWE-287 - Improper Authentication

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/g4p5sf45p3f9r011p…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.22 (semver) Affected: 10.1.0-M1 , ≤ 10.1.55 (semver) Affected: 9.0.13 , ≤ 9.0.118 (semver) Affected: 8.5.38 , ≤ 8.5.100 (semver) Affected: 7.0.100 , ≤ 7.0.109 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-29T22:24:33.117Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/29/24"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-55955",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:21:53.082121Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:22:14.917Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.22",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.55",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.118",
              "status": "affected",
              "version": "9.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.100",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T20:44:39.779Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: EncryptInterceptor not protected against replay attacks",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-55955",
    "datePublished": "2026-06-29T20:44:39.779Z",
    "dateReserved": "2026-06-17T18:04:49.663Z",
    "dateUpdated": "2026-06-30T13:22:14.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55956 (GCVE-0-2026-55956)

Vulnerability from cvelistv5 – Published: 2026-06-29 20:46 – Updated: 2026-06-30 13:25

Title

Apache Tomcat: Security constraints for default servlet ignored method

Summary

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 13:23 UTC

CWE

CWE-285 - Improper Authorization

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/dcjdcnnnww9hhdm01…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.22 (semver) Affected: 10.1.0-M1 , ≤ 10.1.55 (semver) Affected: 9.0.0.M1 , ≤ 9.0.118 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Affected: 7.0.0 , ≤ 7.0.109 (semver) Unknown: 0 , < 7.0.0 (semver)

Credits

j0hndo (dohyun4466@gmail.com)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-29T22:24:34.042Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/29/25"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-55956",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:23:02.427983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:25:31.049Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.22",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.55",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.118",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "j0hndo (dohyun4466@gmail.com)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T20:46:02.927Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Security constraints for default servlet ignored method",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-55956",
    "datePublished": "2026-06-29T20:46:02.927Z",
    "dateReserved": "2026-06-17T18:36:32.030Z",
    "dateUpdated": "2026-06-30T13:25:31.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55957 (GCVE-0-2026-55957)

Vulnerability from cvelistv5 – Published: 2026-06-29 20:47 – Updated: 2026-06-30 13:27

Title

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

Summary

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 13:26 UTC

CWE

CWE-304 - Missing Critical Step in Authentication

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/7fk339o5jvd4mcgsf…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.4 (semver) Affected: 10.1.0-M1 , ≤ 10.1.36 (semver) Affected: 9.0.0.M1 , ≤ 9.0.100 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Affected: 7.0.0 , ≤ 7.0.109 (semver) Unknown: 0 , < 7.0.0 (semver)

Credits

Ilan Toyter

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-29T22:24:34.997Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/29/26"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-55957",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:26:38.087999Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:27:37.064Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.4",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.36",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.100",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ilan Toyter"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-304",
              "description": "CWE-304 Missing Critical Step in Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T20:47:12.661Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-55957",
    "datePublished": "2026-06-29T20:47:12.661Z",
    "dateReserved": "2026-06-17T19:25:28.759Z",
    "dateUpdated": "2026-06-30T13:27:37.064Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59083 (GCVE-0-2026-59083)

Vulnerability from cvelistv5 – Published: 2026-07-14 08:13 – Updated: 2026-07-14 12:19

Title

Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

Summary

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-14 12:19 UTC

CWE

CWE-177 - Improper Handling of URL Encoding (Hex Encoding)

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/3g63zos2gkjo5vgnr…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/07/14/7

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.23 (semver) Affected: 10.1.0-M1 , ≤ 10.1.56 (semver) Affected: 9.0.0.M1 , ≤ 9.0.119 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Unaffected: 0 , < 8.0.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-14T10:33:09.125Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/14/7"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-59083",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T12:19:49.962916Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:19:54.438Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.23",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.56",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.119",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.0.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\u0027s rewrite valve allowed security constraint bypass for some configurations.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100.\u0026nbsp;Other versions that have reached end of support may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\u0027s rewrite valve allowed security constraint bypass for some configurations.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100.\u00a0Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-177",
              "description": "CWE-177 Improper Handling of URL Encoding (Hex Encoding)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T08:13:04.861Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-59083",
    "datePublished": "2026-07-14T08:13:04.861Z",
    "dateReserved": "2026-07-02T10:39:12.023Z",
    "dateUpdated": "2026-07-14T12:19:54.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59084 (GCVE-0-2026-59084)

Vulnerability from cvelistv5 – Published: 2026-07-14 08:24 – Updated: 2026-07-14 13:51

Title

Apache Tomcat: EncryptInterceptor requirements not clearly documented

Summary

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-14 13:51 UTC

CWE

CWE-1059 - Insufficient Technical Documentation

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/7w9746ootcxo0gvx2…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/07/14/8

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.23 (semver) Affected: 10.1.0-M1 , ≤ 10.1.56 (semver) Affected: 9.0.13 , ≤ 9.0.119 (semver) Affected: 8.5.38 , ≤ 8.5.100 (semver) Affected: 7.0.100 , ≤ 7.0.109 (semver)

Credits

NDIx

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-14T10:33:10.332Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/14/8"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-59084",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T13:51:48.818351Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T13:51:52.489Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.23",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.56",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.119",
              "status": "affected",
              "version": "9.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.100",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "NDIx"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInsufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.\u0026nbsp;Other versions that have reached end of support may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.\u00a0Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1059",
              "description": "CWE-1059 Insufficient Technical Documentation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T08:24:21.531Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: EncryptInterceptor requirements not clearly documented",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-59084",
    "datePublished": "2026-07-14T08:24:21.531Z",
    "dateReserved": "2026-07-02T10:42:32.668Z",
    "dateUpdated": "2026-07-14T13:51:52.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:68678

CVE-2026-43515 (GCVE-0-2026-43515)

CVE-2026-50229 (GCVE-0-2026-50229)

CVE-2026-53404 (GCVE-0-2026-53404)

CVE-2026-53434 (GCVE-0-2026-53434)

CVE-2026-55276 (GCVE-0-2026-55276)

CVE-2026-55955 (GCVE-0-2026-55955)

CVE-2026-55956 (GCVE-0-2026-55956)

CVE-2026-55957 (GCVE-0-2026-55957)

CVE-2026-59083 (GCVE-0-2026-59083)

CVE-2026-59084 (GCVE-0-2026-59084)

Tags

Sightings

Nomenclature

Related by attack behaviour