RHSA-2026:32960CriticalCVSS 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
June 29, 2026
Last Modified
August 16, 2026

🔗 CVE IDs covered (7)

CVE-2026-55955 →CVE-2026-55956 →CVE-2026-55957 →CVE-2026-50229 →CVE-2026-53404 →CVE-2026-53434 →CVE-2026-55276 →

📋 Description

CVE-2026-50229 — tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example CVE-2026-53404 — Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing CVE-2026-53434 — tomcat: Apache Tomcat: Error condition not handled when configuring CRLs CVE-2026-55276 — tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow CVE-2026-55955 — tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor CVE-2026-55956 — tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass CVE-2026-55957 — tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration

🎯 Affected products3

  • Red Hat Hardened Images
  • tomcat11-main@noarch as a component of Red Hat Hardened Images
  • tomcat11-main@src as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Remove or disable the Tomcat example web applications if they are deployed. Example applications are not needed for production use and should not be accessible in production environments. Workaround: This vulnerability only affects Tomcat deployments that use the RewriteValve with OR-chained rewrite conditions. Deployments that do not use the RewriteValve are not affected. Review rewrite rules for OR-chained conditions and test rule evaluation behavior. Workaround: This vulnerability only affects Tomcat deployments using the FFM-based connector (requires Java 22+) with CRL-based certificate revocation checking. Deployments using the standard NIO/NIO2 connectors or not using CRL checking are not affected. Workaround: This is a logging-only issue with no runtime security impact. No mitigation is required. Administrators should not rely solely on the effective web.xml debug log output to verify security constraint configuration. Workaround: This vulnerability only affects Tomcat deployments using the EncryptionInterceptor for Tribes cluster communication. Deployments that do not use Tomcat clustering or do not configure the EncryptionInterceptor are not affected. Ensure cluster communication channels are restricted to trusted, isolated networks. Workaround: Review your application's web.xml file. Ensure security constraints explicitly deny unauthorized users by path, rather than relying strictly on filtering specific HTTP methods (like GET or POST). Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

🔗 References (11)