RHSA-2026:93469: Important: tomcat security update

Q: Which Tomcat deployments should be prioritized for this update?

Prioritize deployments that expose HTTP/2, use strict SNI validation, RewriteValve rules, DIGEST or FORM authentication, or enforce security constraints. The update also addresses an HTTP/2 allocation leak that can cause denial of service.

Q: What kinds of attacker access are relevant to these issues?

The advisory identifies bypasses involving HTTP/2 request handling, RewriteValve processing, authentication mechanisms, and access controls. It does not state whether authentication, a particular network position, or a specific application configuration is required for each issue.

Q: Are default Tomcat installations known to be affected?

The provided advisory does not say whether default configurations are affected. Several fixes concern optional or configuration-dependent features, including HTTP/2, RewriteValve, strict SNI validation, DIGEST authentication, and FORM authentication.

Q: How can I determine whether my environment may be exposed before updating?

Review whether your Tomcat instances enable HTTP/2, enforce strict SNI validation, use RewriteValve rules, or rely on DIGEST or FORM authentication and security constraints. The advisory does not provide affected version ranges, detection steps, or indicators of compromise.

Published Nov 2, 2026

Updated

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.Security Fix(es): tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637) tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569) tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905) tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525) tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

9 affected componentsFixes available

redhat/tomcat<9.0.121-1.el9_8

9.0.121-1.el9_8

redhat/tomcat<9.0.121-1.el9_8

9.0.121-1.el9_8

redhat/tomcat-admin-webapps<9.0.121-1.el9_8

9.0.121-1.el9_8

redhat/tomcat-docs-webapp<9.0.121-1.el9_8

9.0.121-1.el9_8

redhat/tomcat-el<3.0-api-9.0.121-1.el9_8

3.0-api-9.0.121-1.el9_8

redhat/tomcat-jsp<2.3-api-9.0.121-1.el9_8

2.3-api-9.0.121-1.el9_8

redhat/tomcat-lib<9.0.121-1.el9_8

9.0.121-1.el9_8

redhat/tomcat-servlet<4.0-api-9.0.121-1.el9_8

4.0-api-9.0.121-1.el9_8

redhat/tomcat-webapps<9.0.121-1.el9_8

9.0.121-1.el9_8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/tomcat to a version that resolves this vulnerability.
Fixed in 9.0.121-1.el9_8
Upgrade
Upgrade redhat/tomcat-admin-webapps to a version that resolves this vulnerability.
Fixed in 9.0.121-1.el9_8
Upgrade
Upgrade redhat/tomcat-docs-webapp to a version that resolves this vulnerability.
Fixed in 9.0.121-1.el9_8
Upgrade
Upgrade redhat/tomcat-el to a version that resolves this vulnerability.
Fixed in 3.0-api-9.0.121-1.el9_8
Upgrade
Upgrade redhat/tomcat-jsp to a version that resolves this vulnerability.
Fixed in 2.3-api-9.0.121-1.el9_8
Upgrade
Upgrade redhat/tomcat-lib to a version that resolves this vulnerability.
Fixed in 9.0.121-1.el9_8
Upgrade
Upgrade redhat/tomcat-servlet to a version that resolves this vulnerability.
Fixed in 4.0-api-9.0.121-1.el9_8
Upgrade
Upgrade redhat/tomcat-webapps to a version that resolves this vulnerability.
Fixed in 9.0.121-1.el9_8

Event History

Nov 2, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

Which Tomcat deployments should be prioritized for this update?

Prioritize deployments that expose HTTP/2, use strict SNI validation, RewriteValve rules, DIGEST or FORM authentication, or enforce security constraints. The update also addresses an HTTP/2 allocation leak that can cause denial of service.

What kinds of attacker access are relevant to these issues?

The advisory identifies bypasses involving HTTP/2 request handling, RewriteValve processing, authentication mechanisms, and access controls. It does not state whether authentication, a particular network position, or a specific application configuration is required for each issue.

Are default Tomcat installations known to be affected?

The provided advisory does not say whether default configurations are affected. Several fixes concern optional or configuration-dependent features, including HTTP/2, RewriteValve, strict SNI validation, DIGEST authentication, and FORM authentication.

How can I determine whether my environment may be exposed before updating?

Review whether your Tomcat instances enable HTTP/2, enforce strict SNI validation, use RewriteValve rules, or rely on DIGEST or FORM authentication and security constraints. The advisory does not provide affected version ranges, detection steps, or indicators of compromise.

RHSA-2026:93469: Important: tomcat security update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Tomcat deployments should be prioritized for this update?

What kinds of attacker access are relevant to these issues?

Are default Tomcat installations known to be affected?

How can I determine whether my environment may be exposed before updating?

Company

Resources

Contact

Frequently Asked Questions

Which Tomcat deployments should be prioritized for this update?

What kinds of attacker access are relevant to these issues?

Are default Tomcat installations known to be affected?

How can I determine whether my environment may be exposed before updating?