RLSA-2026:93469: Important: tomcat security update
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)
tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637)
tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)
tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905)
tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)
tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/tomcatto a version that resolves this vulnerability.Fixed in 1:9.0.121-1.el9_8
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Tomcat deployments are most exposed to the listed issues?
Deployments that use security constraints, RewriteValve rules, strict SNI validation, HTTP/2, DIGEST authentication, or FORM authentication may be exposed, because the listed fixes affect those features. The advisory does not state whether any of these features are enabled by default.
Can these issues be exploited remotely without an existing account?
The advisory rates the update high severity with CVSS 8.2 and lists network attack vector, low attack complexity, no privileges required, and no user interaction. It does not specify which individual CVEs require particular Tomcat configuration or request conditions.
What impacts are covered by this update?
The fixes address access-control and authentication bypasses that can permit unauthorized resource access, an HTTP/2 strict-SNI validation bypass, and an HTTP/2 allocation leak that can cause denial of service. The provided vector indicates high confidentiality impact, low integrity impact, and no availability impact for the overall advisory, though one listed CVE is described as a denial-of-service issue.
How can I determine whether my environment needs this update?
Identify systems running the rocky-linux/tomcat software covered by RLSA-2026:93469, then review whether they use the affected Tomcat features such as HTTP/2, RewriteValve, DIGEST or FORM authentication, security constraints, or strict SNI validation. The advisory does not provide affected or fixed package versions.