Linux · Security advisory · July 23, 2026

RHSA-2026:43401: jws6-tomcat security update

RHSA-2026:43401, released July 23, 2026, fixes 9 CVEs in jws6-tomcat (version 10.1.49-15.redhat_00013.1.el10jws). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0171

77th percentile

Priority of the 9 CVEs

Patch now 0
                                Urgent 0
                                High 7
                                Routine 2

Fixed package versions

Product	Release	Fixed in
jws6-tomcat	RHEL 10	10.1.49-15.redhat_00013.1.el10jws

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2026-41293	jws6-tomcat: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11...	9.8	0.0171	None reported
High	CVE-2026-43512	jws6-tomcat: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects...	9.8	0.0133	None reported
High	CVE-2026-43515	jws6-tomcat: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in...	9.1	0.0122	None reported
High	CVE-2026-41284	jws6-tomcat: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat...	7.5	0.0084	None reported
High	CVE-2026-53404	jws6-tomcat: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first c...	7.3	0.0070	None reported
High	CVE-2026-42498	jws6-tomcat: Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache To...	7.3	0.0069	None reported
High	CVE-2026-43513	jws6-tomcat: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomca...	7.5	0.0050	None reported
Routine	CVE-2026-55956	jws6-tomcat: Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet...	6.5	0.0070	None reported
Routine	CVE-2026-43514	jws6-tomcat: Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tom...	3.7	0.0035	None reported

Also fixes CVE-2026-41293

RHSA-2026:39188
jws7-tomcat on RHEL 10
RHSA-2026:68677
tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more on RHEL 8
ALSA-2026:68677
tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more on almalinux 8
RHSA-2026:67163
tomcat9 on RHEL 10
RHSA-2026:68660
tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more on RHEL 9
ALSA-2026:68651
tomcat9, tomcat9-admin-webapps, tomcat9-docs-webapp and 5 more on almalinux 10
ALSA-2026:68660
tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more on almalinux 9
RLSA-2026:68677
tomcat on rocky 8

Vendor advisory

https://access.redhat.com/errata/RHSA-2026:43401

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo