RHSA-2026:81365HighCVSS 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 12, 2026
Last Modified
October 20, 2026

🔗 CVE IDs covered (8)

CVE-2026-74048 →CVE-2026-74049 →CVE-2026-80353 →CVE-2026-88041 →CVE-2026-93446 →CVE-2026-101296 →CVE-2026-101356 →CVE-2026-103119 →

📋 Description

CVE-2026-74048 — tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure CVE-2026-74049 — tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) CVE-2026-80353 — tomcat: tomcat: Unauthorized socket access via TOCTOU race condition CVE-2026-88041 — tomcat: tomcat: Information disclosure via incomplete HTTP trailer cleanup CVE-2026-93446 — tomcat: Apache Tomcat: Possible TLS 1.3 connection failures CVE-2026-101296 — tomcat: tomcat: Authentication bypass via non-GSSAPI SASL in JNDI realm CVE-2026-101356 — tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing CVE-2026-103119 — tomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes

🎯 Affected products32

  • Red Hat Hardened Images
  • tomcat11-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-0:11.0.27-0.1.hum1@src as a component of Red Hat Hardened Images
  • tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-common-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-common-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-common-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-el-6.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-el-6.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-el-6.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-lib-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-lib-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-lib-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-user-instance-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-user-instance-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-user-instance-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • +2 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to reconfigure Tomcat JNDIRealm to enforce Kerberos GSSAPI authentication and eliminate non-GSSAPI SASL authentication mechanisms: upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123 (or the fixed Tomcat builds), which verify credentials properly during non-GSSAPI SASL authentication in JNDIRealm, closing unauthenticated request to protected realm using non-GSSAPI SASL credentials. Until patched, this is a concern on Tomcat deployments with JNDIRealm configured with a non-GSSAPI SASL authentication mechanism, so restrict network access to endpoints protected by the JNDI realm and avoid using non-GSSAPI SASL authentication configurations. As a compensating measure, intercept and authenticate inbound requests at an identity-aware gateway before they reach the vulnerable Tomcat JNDI realm. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing critical authentication step defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-201 Zero Trust Gateway / Identity-Aware Proxy (medium)

🔗 References (12)