Linux · 
Red Hat · Security advisory · May 27, 2026
Red Hat · Security advisory · May 27, 2026RHSA-2026:67163: tomcat9 security update
RHSA-2026:67163, released May 27, 2026, fixes 28 CVEs in tomcat9 (version 9.0.120-1.el10_0). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
28
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.1034
95th percentile
Priority of the 28 CVEs
Patch now 0
Urgent 1
High 22
Routine 5
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| tomcat9 | RHEL 10 | 9.0.120-1.el10_0 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-59084 | tomcat11: Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the... | 9.1 | 0.0051 | None reported |
| High | CVE-2025-55754 | jws6-tomcat: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape A... | 9.6 | 0.1034 | None reported |
| High | CVE-2025-46701 | libtomcat10-embed-java: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCIservlet allows security constraint bypass o... | 7.3 | 0.0314 | None reported |
| High | CVE-2026-55957 | tomcat: Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authentic... | 7.3 | 0.0286 | None reported |
| High | CVE-2026-41293 | jws6-tomcat: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11... | 9.8 | 0.0171 | None reported |
| High | CVE-2026-43512 | jws6-tomcat: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects... | 9.8 | 0.0133 | None reported |
| High | CVE-2025-61795 | jws6-tomcat: Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limit... | 7.5 | 0.0125 | None reported |
| High | CVE-2026-43515 | jws6-tomcat: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in... | 9.1 | 0.0122 | None reported |
| High | CVE-2026-41284 | jws6-tomcat: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat... | 7.5 | 0.0084 | None reported |
| High | CVE-2026-29145 | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... | 9.1 | 0.0073 | None reported |
| High | CVE-2026-24880 | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... | 7.5 | 0.0071 | None reported |
| High | CVE-2026-53404 | jws6-tomcat: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first c... | 7.3 | 0.0070 | None reported |
| High | CVE-2026-42498 | jws6-tomcat: Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache To... | 7.3 | 0.0069 | None reported |
| High | CVE-2026-55276 | jws7-tomcat: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty author... | 9.1 | 0.0061 | None reported |
| High | CVE-2026-53434 | jws7-tomcat: Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based conn... | 9.1 | 0.0059 | None reported |
| High | CVE-2026-25854 | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... | 7.4 | 0.0058 | None reported |
| High | CVE-2026-24733 | tomcat9: Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method | 7.4 | 0.0055 | None reported |
| High | CVE-2026-59083 | jws7-tomcat: Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security cons... | 9.1 | 0.0052 | None reported |
| High | CVE-2026-43513 | jws6-tomcat: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomca... | 7.5 | 0.0050 | None reported |
| High | CVE-2026-34483 | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... | 7.5 | 0.0047 | None reported |
| High | CVE-2026-34487 | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... | 7.5 | 0.0046 | None reported |
| High | CVE-2026-32990 | tomcat: Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affec... | 7.3 | 0.0031 | None reported |
| High | CVE-2025-66614 | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... | 9.1 | 0.0027 | None reported |
| Routine | CVE-2026-50229 | tomcat11: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess examp... | 6.1 | 0.0409 | None reported |
| Routine | CVE-2025-55668 | jws6-tomcat: Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 t... | 6.5 | 0.0095 | None reported |
Showing 1 to 25 of 28
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.