Red Hat Security Advisory: tomcat9 security update

Fixed packages 8

Vulnerabilities 8

• Critical 9.8
  CVE-2026-41293 Public exploit

  Apache Tomcat: HTTP/2 request headers not validated

  Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also …

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.8
  CVE-2026-43512 Public exploit

  Apache Tomcat: Digest authenticator will authenticate any unknown user

  DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.1
  CVE-2026-43515 Public exploit

  Apache Tomcat: Security constraints not correctly applied

  Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.11…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.1
  CVE-2026-59083

  Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

  Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from …

  Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu
  Jul 14, 2026
• Critical 9.1
  CVE-2026-59084

  Apache Tomcat: EncryptInterceptor requirements not clearly documented

  Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu
  Jul 14, 2026
• High 7.5
  CVE-2026-43513

  Apache Tomcat: LockOutRealm treats user names as case-sensitive

  Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.3
  CVE-2026-42498

  Apache Tomcat: WebSocket authentication header exposure

  Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.2…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Medium 5.3
  CVE-2026-32990

  Apache Tomcat: Fix for CVE-2025-66614 is incomplete

  Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade t…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457025
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476511
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476516
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476519
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2476520
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2499917
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2499931
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99174.json
• report
  https://access.redhat.com/security/cve/CVE-2026-32990
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32990
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32990
• article
  https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7
• report
  https://access.redhat.com/security/cve/CVE-2026-41293
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-41293
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-41293
• article
  https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r
• report
  https://access.redhat.com/security/cve/CVE-2026-42498
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42498
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42498
• article
  https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb
• report
  https://access.redhat.com/security/cve/CVE-2026-43512
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43512
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43512
• article
  https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73
• report
  https://access.redhat.com/security/cve/CVE-2026-43513
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43513
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43513
• article
  https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp
• report
  https://access.redhat.com/security/cve/CVE-2026-43515
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-43515
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-43515
• article
  https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb
• report
  https://access.redhat.com/security/cve/CVE-2026-59083
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59083
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59083
• article
  https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq
• report
  https://access.redhat.com/security/cve/CVE-2026-59084