RHSA-2026:81365HighCVSS 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 12, 2026
Last Modified
October 22, 2026

🔗 CVE IDs covered (8)

CVE-2026-88041 →CVE-2026-93446 →CVE-2026-101296 →CVE-2026-101356 →CVE-2026-103119 →CVE-2026-74048 →CVE-2026-74049 →CVE-2026-80353 →

📋 Description

CVE-2026-74048 — tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure CVE-2026-74049 — tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) CVE-2026-80353 — tomcat: tomcat: Unauthorized socket access via TOCTOU race condition CVE-2026-88041 — tomcat: tomcat: Information disclosure via incomplete HTTP trailer cleanup CVE-2026-93446 — tomcat: Apache Tomcat: Possible TLS 1.3 connection failures CVE-2026-101296 — tomcat: tomcat: Authentication bypass via non-GSSAPI SASL in JNDI realm CVE-2026-101356 — tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing CVE-2026-103119 — tomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes

🎯 Affected products32

  • Red Hat Hardened Images
  • tomcat11-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-0:11.0.27-0.1.hum1@src as a component of Red Hat Hardened Images
  • tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-common-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-common-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-common-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-el-6.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-el-6.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-el-6.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-lib-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-lib-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-lib-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-user-instance-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • tomcat11-user-instance-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • tomcat11-user-instance-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • +2 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally. Workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls. Workaround: Switch affected connectors from APR/Native to the standard NIO connector, or restrict local directory permissions on the socket's parent path to deny unprivileged local users traversal and access. Workaround: Configure front-end reverse proxies to strip HTTP trailer headers and disable backend persistent connection pooling, or set maxKeepAliveRequests="1" on Tomcat HTTP connectors to force separate connections for each request. Workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer. Workaround: The highest-value action is to reconfigure Tomcat JNDIRealm to enforce Kerberos GSSAPI authentication and eliminate non-GSSAPI SASL authentication mechanisms: upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123 (or the fixed Tomcat builds), which verify credentials properly during non-GSSAPI SASL authentication in JNDIRealm, closing unauthenticated request to protected realm using non-GSSAPI SASL credentials. Until patched, this is a concern on Tomcat deployments with JNDIRealm configured with a non-GSSAPI SASL authentication mechanism, so restrict network access to endpoints protected by the JNDI realm and avoid using non-GSSAPI SASL authentication configurations. As a compensating measure, intercept and authenticate inbound requests at an identity-aware gateway before they reach the vulnerable Tomcat JNDI realm. Workaround: Disable the HTTP/2 UpgradeProtocol element in the Connector configuration within server.xml, or configure affected asynchronous servlets to use standard synchronous request handling.

🔗 References (12)