Summary
[1:9.0.120-1]
- Resolves: RHEL-192806 HTTP/2 request headers not validated (CVE-2026-41293)
- Resolves: RHEL-219561 Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
- Resolves: RHEL-219581 Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)
- Resolves: RHEL-238206 tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498)
- Resolves: RHEL-238213 tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
- Resolves: RHEL-238260 tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
- Resolves: RHEL-238294 tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
- Resolves: RHEL-239018 tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | tomcat | 1:9.0.120-1.el8_10 |
| Oracle Linux · 8 | tomcat-admin-webapps | 1:9.0.120-1.el8_10 |
| Oracle Linux · 8 | tomcat-docs-webapp | 1:9.0.120-1.el8_10 |
| Oracle Linux · 8 | tomcat-el-3.0-api | 1:9.0.120-1.el8_10 |
| Oracle Linux · 8 | tomcat-jsp-2.3-api | 1:9.0.120-1.el8_10 |
| Oracle Linux · 8 | tomcat-lib | 1:9.0.120-1.el8_10 |
| Oracle Linux · 8 | tomcat-servlet-4.0-api | 1:9.0.120-1.el8_10 |
| Oracle Linux · 8 | tomcat-webapps | 1:9.0.120-1.el8_10 |
Vulnerabilities 8
-
Critical 9.8CVE-2026-41293 Public exploit
Apache Tomcat: HTTP/2 request headers not validated
Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also …
-
Critical 9.8CVE-2026-43512 Public exploit
Apache Tomcat: Digest authenticator will authenticate any unknown user
DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from…
-
Critical 9.1CVE-2026-43515 Public exploit
Apache Tomcat: Security constraints not correctly applied
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.11…
-
Critical 9.1
Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from …
-
Critical 9.1
Apache Tomcat: EncryptInterceptor requirements not clearly documented
Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.…
-
High 7.5
Apache Tomcat: LockOutRealm treats user names as case-sensitive
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu…
-
High 7.3
Apache Tomcat: WebSocket authentication header exposure
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.2…
-
High 7.3CVE-2026-55957 Public exploit
Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-…