RLSA-2026:98523: Important: tomcat security update
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)
tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637)
tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)
tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905)
tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)
tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/tomcatto a version that resolves this vulnerability.Fixed in 1:9.0.121-3.el9_9 - Upgrade
Upgrade
rocky-linux/tomcat-admin-webappsto a version that resolves this vulnerability.Fixed in 1:9.0.121-3.el9_9 - Upgrade
Upgrade
rocky-linux/tomcat-docs-webappto a version that resolves this vulnerability.Fixed in 1:9.0.121-3.el9_9 - Upgrade
Upgrade
rocky-linux/tomcat-el-3.0-apito a version that resolves this vulnerability.Fixed in 1:9.0.121-3.el9_9 - Upgrade
Upgrade
rocky-linux/tomcat-jsp-2.3-apito a version that resolves this vulnerability.Fixed in 1:9.0.121-3.el9_9 - Upgrade
Upgrade
rocky-linux/tomcat-libto a version that resolves this vulnerability.Fixed in 1:9.0.121-3.el9_9 - Upgrade
Upgrade
rocky-linux/tomcat-servlet-4.0-apito a version that resolves this vulnerability.Fixed in 1:9.0.121-3.el9_9 - Upgrade
Upgrade
rocky-linux/tomcat-webappsto a version that resolves this vulnerability.Fixed in 1:9.0.121-3.el9_9
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Rocky Linux packages are covered by this advisory?
The advisory covers rocky-linux/tomcat and related packages: tomcat-admin-webapps, tomcat-docs-webapp, tomcat-el-3.0-api, tomcat-jsp-2.3-api, tomcat-lib, tomcat-servlet-4.0-api, and tomcat-webapps.
Does exploitation require authentication or user interaction?
The advisory severity vector lists PR:N and UI:N, indicating that the rated issue can be exploited without prior privileges or user interaction. The vector also lists AV:N and AC:L, indicating network reachability and low attack complexity.
What types of Tomcat deployments may be especially relevant when prioritizing remediation?
The listed fixes affect access controls and authentication, including RewriteValve processing, strict SNI validation, DIGEST authentication, and FORM authentication. Deployments using these features, as well as those serving HTTP/2, should be prioritized because the advisory also includes an HTTP/2 allocation-leak denial-of-service issue.
What is the stated impact of the rated issue?
The severity vector indicates high confidentiality impact, low integrity impact, and no availability impact for the rated issue. Separately, the advisory lists a denial-of-service issue caused by an HTTP/2 allocation leak.