Linux · Security advisory · September 19, 2026

RHSA-2026:68660: Security update for 8 packages

RHSA-2026:68660, released September 19, 2026, fixes 16 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
16
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0409
90th percentile

Priority of the 16 CVEs

Patch now 0 Urgent 1 High 11 Routine 4

Fixed package versions

ProductReleaseFixed in
tomcatRHEL 91:9.0.120-2.el9_8
tomcat-admin-webappsRHEL 91:9.0.120-2.el9_8
tomcat-docs-webappRHEL 91:9.0.120-2.el9_8
tomcat-el-3.0-apiRHEL 91:9.0.120-2.el9_8
tomcat-jsp-2.3-apiRHEL 91:9.0.120-2.el9_8
tomcat-libRHEL 91:9.0.120-2.el9_8
tomcat-servlet-4.0-apiRHEL 91:9.0.120-2.el9_8
tomcat-webappsRHEL 91:9.0.120-2.el9_8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2026-59084 tomcat11: Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the... 9.1 0.0051 None reported
High CVE-2026-41293 jws6-tomcat: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11... 9.8 0.0171 None reported
High CVE-2026-43512 jws6-tomcat: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects... 9.8 0.0133 None reported
High CVE-2026-43515 jws6-tomcat: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in... 9.1 0.0122 None reported
High CVE-2026-41284 jws6-tomcat: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat... 7.5 0.0084 None reported
High CVE-2026-53404 jws6-tomcat: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first c... 7.3 0.0070 None reported
High CVE-2026-42498 jws6-tomcat: Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache To... 7.3 0.0069 None reported
High CVE-2026-55276 jws7-tomcat: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty author... 9.1 0.0061 None reported
High CVE-2026-53434 jws7-tomcat: Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based conn... 9.1 0.0059 None reported
High CVE-2026-59083 jws7-tomcat: Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security cons... 9.1 0.0052 None reported
High CVE-2026-43513 jws6-tomcat: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomca... 7.5 0.0050 None reported
High CVE-2026-32990 tomcat: Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affec... 7.3 0.0031 None reported
Routine CVE-2026-50229 tomcat11: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess examp... 6.1 0.0409 None reported
Routine CVE-2026-55956 jws6-tomcat: Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet... 6.5 0.0070 None reported
Routine CVE-2026-55955 tomcat11: Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in t... 6.5 0.0044 None reported
Routine CVE-2026-43514 jws6-tomcat: Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tom... 3.7 0.0035 None reported
Showing 1 to 16 of 16 1