Summary
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)
* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)
Bug Fix(es) and Enhancement(s):
* Tomcat fails to respond to client connections when using Java 8 [almalinux-9.8] (JIRA:AlmaLinux-257456)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | tomcat | 1:9.0.120-2.el9_8 |
| AlmaLinux · 9 | tomcat-admin-webapps | 1:9.0.120-2.el9_8 |
| AlmaLinux · 9 | tomcat-docs-webapp | 1:9.0.120-2.el9_8 |
| AlmaLinux · 9 | tomcat-el-3.0-api | 1:9.0.120-2.el9_8 |
| AlmaLinux · 9 | tomcat-jsp-2.3-api | 1:9.0.120-2.el9_8 |
| AlmaLinux · 9 | tomcat-lib | 1:9.0.120-2.el9_8 |
| AlmaLinux · 9 | tomcat-servlet-4.0-api | 1:9.0.120-2.el9_8 |
| AlmaLinux · 9 | tomcat-webapps | 1:9.0.120-2.el9_8 |
Vulnerabilities 16
-
Critical 9.8CVE-2026-41293 Public exploit
Apache Tomcat: HTTP/2 request headers not validated
Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also …
-
Critical 9.8CVE-2026-43512 Public exploit
Apache Tomcat: Digest authenticator will authenticate any unknown user
DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from…
-
Critical 9.1CVE-2026-43515 Public exploit
Apache Tomcat: Security constraints not correctly applied
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.11…
-
Critical 9.1
Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users ar…
-
Critical 9.1
Apache Tomcat: Logged effective web.xml is incomplete
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22,…
-
Critical 9.1
Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from …
-
Critical 9.1
Apache Tomcat: EncryptInterceptor requirements not clearly documented
Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.…
-
High 7.5
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affec…
-
High 7.5
Apache Tomcat: LockOutRealm treats user names as case-sensitive
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu…
-
High 7.3
Apache Tomcat: WebSocket authentication header exposure
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.2…
-
High 7.3
Apache Tomcat: Bad ornext processing in RewriteValve
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, …
-
Medium 6.5
Apache Tomcat: EncryptInterceptor not protected against replay attacks
Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.…
-
Medium 6.5
Apache Tomcat: Security constraints for default servlet ignored method
Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22…
-
Medium 6.1
Apache Tomcat: XSS in number guess example
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through …
-
Medium 5.3
Apache Tomcat: Fix for CVE-2025-66614 is incomplete
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade t…
-
Low 3.7
Apache Tomcat: AJP secret compared in non-constant time
Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 thr…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-32990
-
report
https://access.redhat.com/security/cve/CVE-2026-41293
-
report
https://access.redhat.com/security/cve/CVE-2026-42498
-
report
https://access.redhat.com/security/cve/CVE-2026-43512
-
report
https://access.redhat.com/security/cve/CVE-2026-43513
-
report
https://access.redhat.com/security/cve/CVE-2026-43515
-
report
https://access.redhat.com/security/cve/CVE-2026-59083
-
report
https://access.redhat.com/security/cve/CVE-2026-59084
-
report
https://bugzilla.redhat.com/2457025
-
report
https://bugzilla.redhat.com/2476511
-
report
https://bugzilla.redhat.com/2476513
-
report
https://bugzilla.redhat.com/2476516
-
report
https://bugzilla.redhat.com/2476519
-
report
https://bugzilla.redhat.com/2476520
-
report
https://bugzilla.redhat.com/2499917
-
report
https://bugzilla.redhat.com/2499931
-
advisory
https://errata.almalinux.org/9/ALSA-2026-68660.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-41284.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-43514.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-50229.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-53404.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-53434.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-55276.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-55955.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-55956.html