Red Hat Security Advisory: tomcat security update

Fixed packages 8

Vulnerabilities 7

• Critical 9.8
  CVE-2026-41293 Public exploit

  Apache Tomcat: HTTP/2 request headers not validated

  Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also …

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.8
  CVE-2026-43512 Public exploit

  Apache Tomcat: Digest authenticator will authenticate any unknown user

  DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.1
  CVE-2026-43515 Public exploit

  Apache Tomcat: Security constraints not correctly applied

  Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.11…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.5
  CVE-2026-43513

  Apache Tomcat: LockOutRealm treats user names as case-sensitive

  Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.3
  CVE-2026-42498

  Apache Tomcat: WebSocket authentication header exposure

  Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.2…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.3
  CVE-2026-55957 Public exploit

  Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

  Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026
• Medium 5.3
  CVE-2026-32990

  Apache Tomcat: Fix for CVE-2025-66614 is incomplete

  Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade t…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457025
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476511
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476516
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476519
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476520
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494669
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67164.json
• report
  https://access.redhat.com/security/cve/CVE-2026-32990
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32990
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32990
• article
  https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7
• report
  https://access.redhat.com/security/cve/CVE-2026-41293
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-41293
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-41293
• article
  https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r
• report
  https://access.redhat.com/security/cve/CVE-2026-42498
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42498
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42498
• article
  https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb
• report
  https://access.redhat.com/security/cve/CVE-2026-43512
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43512
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43512
• article
  https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73
• report
  https://access.redhat.com/security/cve/CVE-2026-43513
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43513
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43513
• article
  https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp
• report
  https://access.redhat.com/security/cve/CVE-2026-43515
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43515
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43515
• article
  https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb
• report
  https://access.redhat.com/security/cve/CVE-2026-55957
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55957
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55957
• article
  https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh