Summary
[1:10.1.49-3]
- Related: RHEL-168577 Remove unnecessary patch
[1:10.1.49-2]
- Resolves: RHEL-168577 Remove tomcat clustering JAR from RPM builds
Resolves: CVE-2026-29146
tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor
Resolves: CVE-2026-34486
tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass
[1:10.1.36-3.el10_1.1]
- Resolves: RHEL-150719
Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | tomcat | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-admin-webapps | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-docs-webapp | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-el-5.0-api | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-jsp-3.1-api | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-lib | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-servlet-6.0-api | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-webapps | 1:10.1.49-3.el10_2 |
Vulnerabilities 3
-
Critical 9.6CVE-2025-55754 EPSS 10%
Apache Tomcat: console manipulation via escape sequences in log messages
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape …
-
High 7.3CVE-2025-46701 Public exploit
Apache Tomcat: Security constraint bypass for CGI scripts
Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0…
-
Medium 6.5CVE-2025-55668 Public exploit
Apache Tomcat: session fixation via rewrite valve
Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended …