Skip to content
OpenAdvisories
Critical RHSA-2026:68258 14 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Sep 22, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 tomcat11 1:11.0.26-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-admin-webapps 1:11.0.26-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-common 1:11.0.26-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-docs-webapp 1:11.0.26-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-el-6.0-api 1:11.0.26-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-jsp-4.0-api 1:11.0.26-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-lib 1:11.0.26-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-servlet-6.1-api 1:11.0.26-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-user-instance 1:11.0.26-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 tomcat11-webapps 1:11.0.26-0.1.hum1

Vulnerabilities 14

  • Critical 9.8
    CVE-2026-76183 Public exploit

    Apache Tomcat: Bypass of security constraints for WebSocket endpoints

    Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 …

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • Critical 9.8
    CVE-2026-86248

    Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Us…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu
  • Critical 9.1
    CVE-2026-86350 Public exploit

    Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

    Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.2…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 8.1
    CVE-2026-68569

    Apache Tomcat: Principal lookup can fail open in some cases

    Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 throu…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 8.1
    CVE-2026-77762

    Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 7.5
    CVE-2026-41284

    Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affec…

    Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-77791

    Apache Tomcat: DoS via busy wait during WebSocket close

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The fo…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 7.5
    CVE-2026-78383

    Apache Tomcat: AJP DoS via missing request body

    Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 7.5
    CVE-2026-79677

    Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout

    Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 th…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 7.5
    CVE-2026-87022

    Apache Tomcat: WebSocket message smuggling with per-message-deflate

    Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 7.3
    CVE-2026-75973

    Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured

    Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • High 7.3
    CVE-2026-78437

    Apache Tomcat: HTTP/2 DoS via malformed request

    Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • Medium 6.5
    CVE-2026-73581

    Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore

    Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 throu…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  • Low 3.7
    CVE-2026-77756

    Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-68569
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-41284
  • report
    https://access.redhat.com/security/cve/CVE-2026-79677
  • report
    https://access.redhat.com/security/cve/CVE-2026-76183
  • report
    https://access.redhat.com/security/cve/CVE-2026-78437
  • report
    https://access.redhat.com/security/cve/CVE-2026-86350
  • report
    https://access.redhat.com/security/cve/CVE-2026-87022
  • report
    https://access.redhat.com/security/cve/CVE-2026-78383
  • report
    https://access.redhat.com/security/cve/CVE-2026-77791
  • report
    https://access.redhat.com/security/cve/CVE-2026-73581
  • report
    https://access.redhat.com/security/cve/CVE-2026-75973
  • report
    https://access.redhat.com/security/cve/CVE-2026-77756
  • report
    https://access.redhat.com/security/cve/CVE-2026-86248
  • report
    https://access.redhat.com/security/cve/CVE-2026-77762
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68258.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2476518
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41284
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41284
  • article
    https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2524160
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-68569
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-68569
  • article
    https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539356
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-73581
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-73581
  • article
    https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539354
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-75973
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-75973
  • article
    https://lists.apache.org/thread/njjcdkkzqyzx4n3ffc4ffjmyh5mpl1gr
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539355
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-76183
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-76183
  • article
    https://lists.apache.org/thread/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2539351
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-77756