Red Hat Security Advisory: tomcat security update

Fixed packages 8

Vulnerabilities 7

• Critical 9.8
  CVE-2026-65637

  Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

  Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to …

  Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  Aug 25, 2026
• Critical 9.8
  CVE-2026-65905

  Apache Tomcat: Limited replay attack possible with DIGEST authentication

  Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that …

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Aug 25, 2026
• Critical 9.1
  CVE-2026-65182

  Apache Tomcat: Bypass longest prefix security constraint

  Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: f…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Aug 25, 2026
• Critical 9.1
  CVE-2026-68525

  Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

  Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, fr…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Aug 25, 2026
• High 8.1
  CVE-2026-68569

  Apache Tomcat: Principal lookup can fail open in some cases

  Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 throu…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  Aug 25, 2026
• High 7.5
  CVE-2026-65927

  Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

  Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 t…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  Aug 25, 2026
• High 7.5
  CVE-2026-68763

  Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

  Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  Aug 25, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524151
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524154
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524155
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524160
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524161
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524162
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2524166
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98523.json
• report
  https://access.redhat.com/security/cve/CVE-2026-65182
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-65182
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-65182
• article
  https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m
• report
  https://access.redhat.com/security/cve/CVE-2026-65637
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-65637
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-65637
• article
  https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj
• report
  https://access.redhat.com/security/cve/CVE-2026-65905
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-65905
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-65905
• article
  https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj
• report
  https://access.redhat.com/security/cve/CVE-2026-65927
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-65927
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-65927
• article
  https://lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4
• report
  https://access.redhat.com/security/cve/CVE-2026-68525
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-68525
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-68525
• article
  https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7
• report
  https://access.redhat.com/security/cve/CVE-2026-68569
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-68569
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-68569
• article
  https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc
• report
  https://access.redhat.com/security/cve/CVE-2026-68763
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-68763
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-68763
• article
  https://lists.apache.org/thread/tv51ty39ppv41v04hdtkp9dp7tg02nzl