Skip to content
OpenAdvisories
Critical RHSA-2026:36872 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jul 30, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 tomcat11 1:11.0.24-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-admin-webapps 1:11.0.24-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-common 1:11.0.24-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-docs-webapp 1:11.0.24-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-el-6.0-api 1:11.0.24-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-jsp-4.0-api 1:11.0.24-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-lib 1:11.0.24-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-servlet-6.1-api 1:11.0.24-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-user-instance 1:11.0.24-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-webapps 1:11.0.24-0.1.hum1

Vulnerabilities 2

  • Critical 9.1
    CVE-2026-59083

    Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

    Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from …

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu
  • Critical 9.1
    CVE-2026-59084

    Apache Tomcat: EncryptInterceptor requirements not clearly documented

    Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-59084
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-59083
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36872.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499917
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59083
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59083
  • article
    https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499931
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59084
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59084
  • article
    https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7