Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 10

Vulnerabilities 4

• Critical 9.8
  CVE-2026-43512 Public exploit

  Apache Tomcat: Digest authenticator will authenticate any unknown user

  DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.1
  CVE-2026-43515 Public exploit

  Apache Tomcat: Security constraints not correctly applied

  Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.11…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.3
  CVE-2026-42498

  Apache Tomcat: WebSocket authentication header exposure

  Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.2…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Low 3.7
  CVE-2026-43514

  Apache Tomcat: AJP secret compared in non-constant time

  Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 thr…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-43512
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-43515
• report
  https://access.redhat.com/security/cve/CVE-2026-42498
• report
  https://access.redhat.com/security/cve/CVE-2026-43514
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16528.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476516
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42498
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42498
• article
  https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476511
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43512
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43512
• article
  https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476512
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43514
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43514
• article
  https://lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476519
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43515
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43515
• article
  https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb