Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 10

Vulnerabilities 6

• Critical 9.1
  CVE-2026-53434

  Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

  Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users ar…

  Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven
  Jun 29, 2026
• Critical 9.1
  CVE-2026-55276

  Apache Tomcat: Logged effective web.xml is incomplete

  Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22,…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026
• High 7.3
  CVE-2026-53404

  Apache Tomcat: Bad ornext processing in RewriteValve

  Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, …

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026
• High 7.3
  CVE-2026-55957 Public exploit

  Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

  Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026
• Medium 6.5
  CVE-2026-55955

  Apache Tomcat: EncryptInterceptor not protected against replay attacks

  Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026
• Medium 6.5
  CVE-2026-55956

  Apache Tomcat: Security constraints for default servlet ignored method

  Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-55955
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-55956
• report
  https://access.redhat.com/security/cve/CVE-2026-55957
• report
  https://access.redhat.com/security/cve/CVE-2026-55276
• report
  https://access.redhat.com/security/cve/CVE-2026-53404
• report
  https://access.redhat.com/security/cve/CVE-2026-53434
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_29203.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494681
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53404
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53404
• article
  https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494668
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-53434
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-53434
• article
  https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494675
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55276
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55276
• article
  https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494678
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55955
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55955
• article
  https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494676
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55956
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55956
• article
  https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494669
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55957
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55957
• article
  https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh