Linux · Security advisory · September 19, 2026
RHSA-2026:68677: Security update for 8 packages
RHSA-2026:68677, released September 19, 2026, fixes 29 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
29
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.1034
95th percentile
Priority of the 29 CVEs
Patch now 0
Urgent 1
High 23
Routine 5
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| tomcat | RHEL 8 | 1:9.0.120-1.el8_10 |
| tomcat-admin-webapps | RHEL 8 | 1:9.0.120-1.el8_10 |
| tomcat-docs-webapp | RHEL 8 | 1:9.0.120-1.el8_10 |
| tomcat-el-3.0-api | RHEL 8 | 1:9.0.120-1.el8_10 |
| tomcat-jsp-2.3-api | RHEL 8 | 1:9.0.120-1.el8_10 |
| tomcat-lib | RHEL 8 | 1:9.0.120-1.el8_10 |
| tomcat-servlet-4.0-api | RHEL 8 | 1:9.0.120-1.el8_10 |
| tomcat-webapps | RHEL 8 | 1:9.0.120-1.el8_10 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2026-59084 | tomcat11: Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the... | 9.1 | 0.0051 | None reported | |
| High | CVE-2025-55754 | jws6-tomcat: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape A... | 9.6 | 0.1034 | None reported | |
| High | CVE-2024-52316 | tomcat: Unchecked Error Condition vulnerability in Apache Tomcat | 9.8 | 0.0625 | None reported | |
| High | CVE-2025-46701 | libtomcat10-embed-java: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCIservlet allows security constraint bypass o... | 7.3 | 0.0314 | None reported | |
| High | CVE-2026-55957 | tomcat: Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authentic... | 7.3 | 0.0286 | None reported | |
| High | CVE-2024-54677 | tomcat: Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to... | 8.6 | 0.0194 | None reported | |
| High | CVE-2026-41293 | jws6-tomcat: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11... | 9.8 | 0.0171 | None reported | |
| High | CVE-2026-43512 | jws6-tomcat: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects... | 9.8 | 0.0133 | None reported | |
| High | CVE-2025-61795 | jws6-tomcat: Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limit... | 7.5 | 0.0125 | None reported | |
| High | CVE-2026-43515 | jws6-tomcat: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in... | 9.1 | 0.0122 | None reported | |
| High | CVE-2026-41284 | jws6-tomcat: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat... | 7.5 | 0.0084 | None reported | |
| High | CVE-2026-29145 | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... | 9.1 | 0.0073 | None reported | |
| High | CVE-2026-24880 | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... | 7.5 | 0.0071 | None reported | |
| High | CVE-2026-53404 | jws6-tomcat: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first c... | 7.3 | 0.0070 | None reported | |
| High | CVE-2026-42498 | jws6-tomcat: Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache To... | 7.3 | 0.0069 | None reported | |
| High | CVE-2026-55276 | jws7-tomcat: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty author... | 9.1 | 0.0061 | None reported | |
| High | CVE-2026-53434 | jws7-tomcat: Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based conn... | 9.1 | 0.0059 | None reported | |
| High | CVE-2026-25854 | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... | 7.4 | 0.0058 | None reported | |
| High | CVE-2026-24733 | tomcat9: Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method | 7.4 | 0.0055 | None reported | |
| High | CVE-2026-59083 | jws7-tomcat: Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security cons... | 9.1 | 0.0052 | None reported | |
| High | CVE-2026-43513 | jws6-tomcat: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomca... | 7.5 | 0.0050 | None reported | |
| High | CVE-2026-34483 | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... | 7.5 | 0.0047 | None reported | |
| High | CVE-2026-34487 | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... | 7.5 | 0.0046 | None reported | |
| High | CVE-2025-66614 | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... | 9.1 | 0.0027 | None reported | |
| Routine | CVE-2026-50229 | tomcat11: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess examp... | 6.1 | 0.0409 | None reported |
Showing 1 to 25 of 29
1Next