Red Hat Security Advisory: tomcat update

Fixed packages 8

Vulnerabilities 6

• Critical 9.8
  CVE-2026-41293 Public exploit

  Apache Tomcat: HTTP/2 request headers not validated

  Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also …

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.8
  CVE-2026-43512 Public exploit

  Apache Tomcat: Digest authenticator will authenticate any unknown user

  DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.1
  CVE-2026-43515 Public exploit

  Apache Tomcat: Security constraints not correctly applied

  Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.11…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.5
  CVE-2026-43513

  Apache Tomcat: LockOutRealm treats user names as case-sensitive

  Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.3
  CVE-2026-42498

  Apache Tomcat: WebSocket authentication header exposure

  Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.2…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Medium 5.3
  CVE-2026-32990

  Apache Tomcat: Fix for CVE-2025-66614 is incomplete

  Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade t…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457025
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476511
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476516
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476519
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69259.json
• report
  https://access.redhat.com/security/cve/CVE-2026-32990
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32990
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32990
• article
  https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7
• report
  https://access.redhat.com/security/cve/CVE-2026-41293
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-41293
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-41293
• article
  https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r
• report
  https://access.redhat.com/security/cve/CVE-2026-42498
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42498
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42498
• article
  https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb
• report
  https://access.redhat.com/security/cve/CVE-2026-43512
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43512
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43512
• article
  https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73
• report
  https://access.redhat.com/security/cve/CVE-2026-43513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476520
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43513
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43513
• article
  https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp
• report
  https://access.redhat.com/security/cve/CVE-2026-43515
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43515
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43515
• article
  https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb