RHSA-2026:56039HighCVSS 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
August 18, 2026
Last Modified
September 7, 2026

🔗 CVE IDs covered (10)

CVE-2026-65927 →CVE-2026-66299 →CVE-2026-68763 →CVE-2026-65182 →CVE-2026-65183 →CVE-2026-65637 →CVE-2026-66422 →CVE-2026-68525 →CVE-2026-73180 →CVE-2026-65905 →

📋 Description

CVE-2026-65182 — Apache Tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65183 — tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition CVE-2026-65637 — Apache Tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 — tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-65927 — tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing CVE-2026-66299 — tomcat: Apache Tomcat: Denial of Service via WebSocket chat example CVE-2026-66422 — tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints CVE-2026-68525 — org.apache.tomcat/tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-68763 — org.apache.tomcat/tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak CVE-2026-73180 — tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination

🎯 Affected products3

  • Red Hat Hardened Images
  • tomcat11-main@noarch as a component of Red Hat Hardened Images
  • tomcat11-main@src as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this issue, ensure that security constraints in Apache Tomcat's web.xml configuration files are ordered from most specific to least specific. More restrictive constraints for shorter sub-paths must be defined before broader constraints for longer paths. Incorrect ordering can lead to a bypass of intended access controls. After modifying web.xml, a restart or reload of the Apache Tomcat service is required for the changes to take effect, which may temporarily interrupt service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, disable DIGEST authentication in Apache Tomcat if it is not a required authentication mechanism for your deployment. Refer to the Apache Tomcat documentation for guidance on configuring authentication methods. Disabling DIGEST authentication will affect services that depend on it. A restart of the Tomcat service is necessary for the configuration changes to be applied. Workaround: To mitigate this vulnerability, remove the `examples` web application from your Apache Tomcat installation. This can typically be achieved by deleting the `examples` directory or `examples.war` file from the `webapps` directory of your Tomcat installation. A restart of the Tomcat service may be required for the changes to take full effect. Workaround: To mitigate this vulnerability, disable the HTTP/2 protocol in Apache Tomcat if it is not required for your deployment. This can be achieved by commenting out or removing the <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" /> element within the <Connector> configuration in the server.xml file. After modifying server.xml, a restart of the Apache Tomcat service is required for the changes to take effect.

🔗 References (14)