{"id":"RHSA-2026:68659","summary":"Red Hat Security Advisory: tomcat security update","modified":"2026-10-17T10:18:37Z","published":"2026-09-18T10:15:27Z","upstream":["CVE-2024-52316","CVE-2024-54677","CVE-2025-46701","CVE-2025-55668","CVE-2025-55754","CVE-2025-61795","CVE-2025-66614","CVE-2026-24733","CVE-2026-24880","CVE-2026-25854","CVE-2026-29145","CVE-2026-32990","CVE-2026-34483","CVE-2026-34487","CVE-2026-41284","CVE-2026-41293","CVE-2026-42498","CVE-2026-43512","CVE-2026-43513","CVE-2026-43514","CVE-2026-43515","CVE-2026-50229","CVE-2026-53404","CVE-2026-53434","CVE-2026-55276","CVE-2026-55955","CVE-2026-55956","CVE-2026-55957","CVE-2026-59083","CVE-2026-59084"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:68659"},{"type":"ARTICLE","url":"https://access.redhat.com/security/updates/classification/#important"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457025"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476511"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476513"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476516"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476519"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476520"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494669"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499917"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499931"},{"type":"ADVISORY","url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68659.json"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2024-52316"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326972"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2024-52316"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52316"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2024-54677"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2332815"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2024-54677"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54677"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2025-46701"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369253"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2025-46701"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46701"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2025-55668"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2388226"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2025-55668"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55668"},{"type":"ARTICLE","url":"https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6"},{"type":"ARTICLE","url":"https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21"},{"type":"ARTICLE","url":"https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2025-55754"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2406590"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2025-55754"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55754"},{"type":"ARTICLE","url":"https://github.com/apache/tomcat/commit/5a3db092982c0c58d4855304167ee757fe5e79bb"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2025-61795"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2406588"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2025-61795"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61795"},{"type":"ARTICLE","url":"https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2025-66614"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2440430"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2025-66614"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66614"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-24733"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2440437"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-24733"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24733"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-24880"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457040"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-24880"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24880"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-25854"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457039"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-25854"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25854"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-29145"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457037"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-29145"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29145"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-32990"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-32990"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32990"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-34483"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457044"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-34483"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34483"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-34487"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457038"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-34487"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34487"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-41284"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476518"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-41284"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41284"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-41293"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-41293"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41293"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-42498"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-42498"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42498"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-43512"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-43512"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43512"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-43513"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-43513"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43513"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-43514"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476512"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-43514"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43514"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-43515"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-43515"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43515"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-50229"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494688"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-50229"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50229"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-53404"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494681"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-53404"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53404"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-53434"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494668"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-53434"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53434"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-55276"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494675"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-55276"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55276"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-55955"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494678"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-55955"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55955"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-55956"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494676"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-55956"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55956"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-55957"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-55957"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55957"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-59083"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-59083"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59083"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-59084"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-59084"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59084"},{"type":"ARTICLE","url":"https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7"}],"affected":[{"package":{"name":"tomcat","ecosystem":"Red Hat:rhel_eus:9.6::appstream","purl":"pkg:rpm/redhat/tomcat"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:68659.json"}},{"package":{"name":"tomcat-admin-webapps","ecosystem":"Red Hat:rhel_eus:9.6::appstream","purl":"pkg:rpm/redhat/tomcat-admin-webapps"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:68659.json"}},{"package":{"name":"tomcat-docs-webapp","ecosystem":"Red Hat:rhel_eus:9.6::appstream","purl":"pkg:rpm/redhat/tomcat-docs-webapp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:68659.json"}},{"package":{"name":"tomcat-el-3.0-api","ecosystem":"Red Hat:rhel_eus:9.6::appstream","purl":"pkg:rpm/redhat/tomcat-el-3.0-api"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:68659.json"}},{"package":{"name":"tomcat-jsp-2.3-api","ecosystem":"Red Hat:rhel_eus:9.6::appstream","purl":"pkg:rpm/redhat/tomcat-jsp-2.3-api"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:68659.json"}},{"package":{"name":"tomcat-lib","ecosystem":"Red Hat:rhel_eus:9.6::appstream","purl":"pkg:rpm/redhat/tomcat-lib"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:68659.json"}},{"package":{"name":"tomcat-servlet-4.0-api","ecosystem":"Red Hat:rhel_eus:9.6::appstream","purl":"pkg:rpm/redhat/tomcat-servlet-4.0-api"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:68659.json"}},{"package":{"name":"tomcat-webapps","ecosystem":"Red Hat:rhel_eus:9.6::appstream","purl":"pkg:rpm/redhat/tomcat-webapps"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:68659.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}