Linux · Security advisory · September 19, 2026

RLSA-2026:68677: tomcat security update

RLSA-2026:68677, released September 19, 2026, fixes 8 CVEs in tomcat (version 1:9.0.120-1.el8_10). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

1 rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0286

86th percentile

Priority of the 8 CVEs

Patch now 0
                                Urgent 1
                                High 7
                                Routine 0

Fixed package versions

Product	Release	Fixed in
tomcat	rocky 8	1:9.0.120-1.el8_10

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-59084	tomcat11: Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the...	9.1	0.0051	None reported
High	CVE-2026-55957	tomcat: Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authentic...	7.3	0.0286	None reported
High	CVE-2026-41293	jws6-tomcat: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11...	9.8	0.0171	None reported
High	CVE-2026-43512	jws6-tomcat: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects...	9.8	0.0133	None reported
High	CVE-2026-43515	jws6-tomcat: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in...	9.1	0.0122	None reported
High	CVE-2026-42498	jws6-tomcat: Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache To...	7.3	0.0069	None reported
High	CVE-2026-59083	jws7-tomcat: Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security cons...	9.1	0.0052	None reported
High	CVE-2026-43513	jws6-tomcat: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomca...	7.5	0.0050	None reported

Also fixes CVE-2026-59084

RHSA-2026:68677
tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more on RHEL 8
ALSA-2026:68677
tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more on almalinux 8
RHSA-2026:67163
tomcat9 on RHEL 10
RHSA-2026:68660
tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more on RHEL 9
ALSA-2026:68651
tomcat9, tomcat9-admin-webapps, tomcat9-docs-webapp and 5 more on almalinux 10
ALSA-2026:68660
tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 5 more on almalinux 9
ALAS2023-2026-1945
tomcat9, tomcat9-admin-webapps, tomcat9-docs-webapp and 5 more on amzn 2023
ALAS2023-2026-1946
tomcat10, tomcat10-admin-webapps, tomcat10-docs-webapp and 5 more on amzn 2023

Vendor advisory

https://errata.rockylinux.org/RLSA-2026:68677

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo