Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 10 enterprise_linux:10.2 | tomcat | 1:10.1.49-1.el10_2.1 |
| Red Hat · RHEL 10 enterprise_linux:10.2 | tomcat-admin-webapps | 1:10.1.49-1.el10_2.1 |
| Red Hat · RHEL 10 enterprise_linux:10.2 | tomcat-docs-webapp | 1:10.1.49-1.el10_2.1 |
| Red Hat · RHEL 10 enterprise_linux:10.2 | tomcat-el-5.0-api | 1:10.1.49-1.el10_2.1 |
| Red Hat · RHEL 10 enterprise_linux:10.2 | tomcat-jsp-3.1-api | 1:10.1.49-1.el10_2.1 |
| Red Hat · RHEL 10 enterprise_linux:10.2 | tomcat-lib | 1:10.1.49-1.el10_2.1 |
| Red Hat · RHEL 10 enterprise_linux:10.2 | tomcat-servlet-6.0-api | 1:10.1.49-1.el10_2.1 |
| Red Hat · RHEL 10 enterprise_linux:10.2 | tomcat-webapps | 1:10.1.49-1.el10_2.1 |
Vulnerabilities 1
-
High 7.4
Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could al…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2440426
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19054.json
-
report
https://access.redhat.com/security/cve/CVE-2026-24734
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-24734
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-24734
-
article
https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml