RHSA-2026:93618
Vulnerability from csaf_redhat - Published: 2026-11-03 13:52 - Updated: 2026-11-03 18:24Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.3 release and security update
Severity
Important
Notes
Topic: Red Hat JBoss Web Server 7.0.3 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 7.0.3 serves as a replacement for Red Hat JBoss Web Server 7.0.2. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.
Security Fix(es):
* mod_cluster-core: mod_cluster Advertise Listener: unauthenticated DoS via crafted multicast datagram (CVE-2026-76166)
* jws7-tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition (CVE-2026-86247)
* jws7-tomcat: Apache Tomcat: Denial of Service via AJP request (CVE-2026-78383)
* jws7-tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close (CVE-2026-77791)
* jws7-tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up (CVE-2026-86350)
* jws7-tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints (CVE-2026-76183)
* jws7-tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts (CVE-2026-79677)
* jws7-tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists (CVE-2026-73581)
* jws7-tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVE-2026-86248)
* jws7-tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake (CVE-2026-86243)
* jws7-tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration (CVE-2026-86246)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM Transport Layer Security (TLS) implementations fail to properly check Certificate Revocation Lists (CRLs) when a certificate uses a keystore. This oversight could allow an attacker to use a revoked certificate, potentially leading to unauthorized access or impersonation of a legitimate server or client.
6.5 (Medium)
Affected products
Fixed
51 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.
4.3 (Medium)
Affected products
Fixed
51 products, the same list as for
CVE-2026-73581
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. This vulnerability, known as an 'Authentication Bypass by Alternate Name', allows an attacker to bypass the security restrictions set for WebSocket endpoints. This means that unauthorized users could gain access to protected resources or functionality, potentially leading to sensitive information disclosure or other unauthorized actions.
7.4 (High)
Affected products
Fixed
51 products, the same list as for
CVE-2026-73581
Threats
Impact
Important
A flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability occurs when sending a WebSocket close message, which can lead to a busy wait condition. A remote attacker could exploit this to cause a Denial of Service (DoS) by making the server unresponsive.
7.5 (High)
Affected products
Fixed
51 products, the same list as for
CVE-2026-73581
Threats
Impact
Important
A flaw was found in Apache Tomcat. An unauthenticated remote attacker can send a specially crafted AJP (Apache JServ Protocol) request, causing an AJP processing thread to become unresponsive. This resource exhaustion can lead to a denial of service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
51 products, the same list as for
CVE-2026-73581
Threats
Impact
Important
A flaw was found in Apache Tomcat. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by exploiting lost timeouts for asynchronous WebSocket writes. This can lead to the affected system becoming unresponsive or unavailable.
7.5 (High)
Affected products
Fixed
51 products, the same list as for
CVE-2026-73581
Threats
Impact
Moderate
A flaw was found in Apache Tomcat Native. A remote attacker can exploit a buffer over-read vulnerability during the Transport Layer Security (TLS) handshake. Successful exploitation causes the Java Virtual Machine (JVM) to crash, resulting in a denial of service (DoS).
7.5 (High)
Affected products
Fixed
51 products, the same list as for
CVE-2026-73581
Threats
Impact
Important
A flaw was found in Apache Tomcat Native, which enabled several insecure OpenSSL options by default: ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX. These defaults can weaken TLS protections. Apache Tomcat Native versions 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 are affected; the issue is fixed in versions 1.3.9 and 2.0.16.
5.3 (Medium)
Affected products
Fixed
51 products, the same list as for
CVE-2026-73581
Threats
Impact
Moderate
A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or reduced security posture.
4.8 (Medium)
Affected products
Fixed
51 products, the same list as for
CVE-2026-73581
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. When client certificate authentication is configured with strict certificate revocation checking, Online Certificate Status Protocol (OCSP) verification may improperly allow connections instead of failing as intended. A remote attacker presenting an invalid or revoked client certificate could exploit this issue to bypass authentication and gain unauthorized access to protected resources.
5.9 (Medium)
Affected products
Fixed
51 products, the same list as for
CVE-2026-73581
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security mechanisms or gain unauthorized access to sensitive information.
7.2 (High)
Affected products
Fixed
51 products, the same list as for
CVE-2026-73581
Threats
Impact
Important
References
70 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Web Server 7.0.3 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 7.0.3 serves as a replacement for Red Hat JBoss Web Server 7.0.2. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.\n\nSecurity Fix(es):\n\n* mod_cluster-core: mod_cluster Advertise Listener: unauthenticated DoS via crafted multicast datagram (CVE-2026-76166)\n* jws7-tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition (CVE-2026-86247)\n* jws7-tomcat: Apache Tomcat: Denial of Service via AJP request (CVE-2026-78383)\n* jws7-tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close (CVE-2026-77791)\n* jws7-tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up (CVE-2026-86350)\n* jws7-tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints (CVE-2026-76183)\n* jws7-tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts (CVE-2026-79677)\n* jws7-tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists (CVE-2026-73581)\n* jws7-tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVE-2026-86248)\n* jws7-tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake (CVE-2026-86243)\n* jws7-tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration (CVE-2026-86246)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:93618",
"url": "https://access.redhat.com/errata/RHSA-2026:93618"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/7.0/html/red_hat_jboss_web_server_7.0_service_pack_3_release_notes/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/7.0/html/red_hat_jboss_web_server_7.0_service_pack_3_release_notes/index"
},
{
"category": "external",
"summary": "2510883",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510883"
},
{
"category": "external",
"summary": "2539355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539355"
},
{
"category": "external",
"summary": "2539356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539356"
},
{
"category": "external",
"summary": "2539370",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539370"
},
{
"category": "external",
"summary": "2539393",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539393"
},
{
"category": "external",
"summary": "2539394",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539394"
},
{
"category": "external",
"summary": "2539395",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539395"
},
{
"category": "external",
"summary": "2539396",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539396"
},
{
"category": "external",
"summary": "2539486",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539486"
},
{
"category": "external",
"summary": "2539616",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539616"
},
{
"category": "external",
"summary": "2542847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542847"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_93618.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.3 release and security update",
"tracking": {
"current_release_date": "2026-11-03T18:24:26+00:00",
"generator": {
"date": "2026-11-03T18:24:26+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:93618",
"initial_release_date": "2026-11-03T13:52:32+00:00",
"revision_history": [
{
"date": "2026-11-03T13:52:32+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-03T13:52:32+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-03T18:24:26+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 7.0 on RHEL 10",
"product": {
"name": "Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:7.0::el10"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 7.0 on RHEL 8",
"product": {
"name": "Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:7.0::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 7.0 on RHEL 9",
"product": {
"name": "Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:7.0::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"product": {
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"product_id": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-mod_cluster@2.1.1-1.Final_redhat_00001.1.el10jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"product": {
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"product_id": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-native@1.3.7-4.redhat_4.el10jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"product": {
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"product_id": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat@11.0.21-10.redhat_00010.1.el10jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"product": {
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"product_id": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-mod_cluster@2.1.1-1.Final_redhat_00001.1.el8jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"product": {
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"product_id": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-native@1.3.7-4.redhat_4.el8jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"product": {
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"product_id": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat@11.0.21-10.redhat_00010.1.el8jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"product": {
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"product_id": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-mod_cluster@2.1.1-1.Final_redhat_00001.1.el9jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"product": {
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"product_id": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-native@1.3.7-4.redhat_4.el9jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"product": {
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"product_id": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat@11.0.21-10.redhat_00010.1.el9jws?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"product": {
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"product_id": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-mod_cluster@2.1.1-1.Final_redhat_00001.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"product": {
"name": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"product_id": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-mod_cluster-tomcat@2.1.1-1.Final_redhat_00001.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_id": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat@11.0.21-10.redhat_00010.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_id": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-admin-webapps@11.0.21-10.redhat_00010.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_id": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-docs-webapp@11.0.21-10.redhat_00010.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_id": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-el-5.0-api@11.0.21-10.redhat_00010.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_id": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-javadoc@11.0.21-10.redhat_00010.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_id": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-jsp-3.1-api@11.0.21-10.redhat_00010.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_id": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-lib@11.0.21-10.redhat_00010.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_id": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-selinux@11.0.21-10.redhat_00010.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_id": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-servlet-6.0-api@11.0.21-10.redhat_00010.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product": {
"name": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_id": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-webapps@11.0.21-10.redhat_00010.1.el10jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"product": {
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"product_id": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-mod_cluster@2.1.1-1.Final_redhat_00001.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"product": {
"name": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"product_id": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-mod_cluster-tomcat@2.1.1-1.Final_redhat_00001.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_id": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat@11.0.21-10.redhat_00010.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_id": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-admin-webapps@11.0.21-10.redhat_00010.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_id": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-docs-webapp@11.0.21-10.redhat_00010.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_id": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-el-5.0-api@11.0.21-10.redhat_00010.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_id": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-javadoc@11.0.21-10.redhat_00010.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_id": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-jsp-3.1-api@11.0.21-10.redhat_00010.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_id": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-lib@11.0.21-10.redhat_00010.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_id": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-selinux@11.0.21-10.redhat_00010.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_id": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-servlet-6.0-api@11.0.21-10.redhat_00010.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product": {
"name": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_id": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-webapps@11.0.21-10.redhat_00010.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"product": {
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"product_id": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-mod_cluster@2.1.1-1.Final_redhat_00001.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"product": {
"name": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"product_id": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-mod_cluster-tomcat@2.1.1-1.Final_redhat_00001.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_id": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat@11.0.21-10.redhat_00010.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_id": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-admin-webapps@11.0.21-10.redhat_00010.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_id": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-docs-webapp@11.0.21-10.redhat_00010.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_id": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-el-5.0-api@11.0.21-10.redhat_00010.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_id": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-javadoc@11.0.21-10.redhat_00010.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_id": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-jsp-3.1-api@11.0.21-10.redhat_00010.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_id": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-lib@11.0.21-10.redhat_00010.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_id": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-selinux@11.0.21-10.redhat_00010.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_id": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-servlet-6.0-api@11.0.21-10.redhat_00010.1.el9jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product": {
"name": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_id": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-webapps@11.0.21-10.redhat_00010.1.el9jws?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"product": {
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"product_id": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-native@1.3.7-4.redhat_4.el10jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"product": {
"name": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"product_id": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-native-debuginfo@1.3.7-4.redhat_4.el10jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"product": {
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"product_id": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-native@1.3.7-4.redhat_4.el8jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"product": {
"name": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"product_id": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-native-debuginfo@1.3.7-4.redhat_4.el8jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"product": {
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"product_id": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-native@1.3.7-4.redhat_4.el9jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"product": {
"name": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"product_id": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws7-tomcat-native-debuginfo@1.3.7-4.redhat_4.el9jws?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch"
},
"product_reference": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src"
},
"product_reference": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch"
},
"product_reference": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src"
},
"product_reference": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src"
},
"product_reference": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64"
},
"product_reference": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64"
},
"product_reference": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 10",
"product_id": "10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch"
},
"product_reference": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"relates_to_product_reference": "10Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch"
},
"product_reference": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src"
},
"product_reference": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch"
},
"product_reference": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src"
},
"product_reference": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src"
},
"product_reference": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64"
},
"product_reference": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64"
},
"product_reference": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 8",
"product_id": "8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch"
},
"product_reference": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch"
},
"product_reference": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src"
},
"product_reference": "jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch"
},
"product_reference": "jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src"
},
"product_reference": "jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src"
},
"product_reference": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64"
},
"product_reference": "jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64 as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64"
},
"product_reference": "jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch as a component of Red Hat JBoss Web Server 7.0 on RHEL 9",
"product_id": "9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
},
"product_reference": "jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"relates_to_product_reference": "9Base-JWS-7.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-73581",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-09-23T11:31:24.479771+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539356"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM Transport Layer Security (TLS) implementations fail to properly check Certificate Revocation Lists (CRLs) when a certificate uses a keystore. This oversight could allow an attacker to use a revoked certificate, potentially leading to unauthorized access or impersonation of a legitimate server or client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact for Red Hat products because successful exploitation requires a specific configuration combining OpenSSL-based TLS with keystores while relying on Certificate Revocation List (CRL) validation. Typical deployments using standard Java JSSE providers or configurations without CRL verification are not affected by this behavior. Furthermore, exploitation is limited to scenarios where an attacker already possesses a legitimately issued certificate that has been revoked by the issuing authority.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73581"
},
{
"category": "external",
"summary": "RHBZ#2539356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73581"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73581",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73581"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do",
"url": "https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do"
}
],
"release_date": "2026-09-23T11:08:53.212000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:52:32+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93618"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists"
},
{
"acknowledgments": [
{
"names": [
"Ta Duc Thien",
"Kien Pham"
],
"organization": "Ninh Thanh Cyber Security (NTCS)"
}
],
"cve": "CVE-2026-76166",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-07-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510883"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in mod_cluster\u0027s AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a \"Server:\" header but without the \"Date:\", \"Digest:\", and \"Sequence:\" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread\u0027s exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "modcluster-core: mod_cluster Advertise Listener: unauthenticated DoS via crafted multicast datagram",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76166"
},
{
"category": "external",
"summary": "RHBZ#2510883",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510883"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76166",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76166"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76166",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76166"
}
],
"release_date": "2026-08-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:52:32+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93618"
},
{
"category": "workaround",
"details": "Disable multicast-based proxy advertisement and use static proxy configuration instead. When advertisement must be enabled, ensure the multicast network segment (default 224.0.1.105:23364) is properly isolated and not accessible from untrusted network segments.",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "modcluster-core: mod_cluster Advertise Listener: unauthenticated DoS via crafted multicast datagram"
},
{
"cve": "CVE-2026-76183",
"cwe": {
"id": "CWE-289",
"name": "Authentication Bypass by Alternate Name"
},
"discovery_date": "2026-09-23T11:31:14.311894+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539355"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. This vulnerability, known as an \u0027Authentication Bypass by Alternate Name\u0027, allows an attacker to bypass the security restrictions set for WebSocket endpoints. This means that unauthorized users could gain access to protected resources or functionality, potentially leading to sensitive information disclosure or other unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important severity because unauthenticated remote attackers can circumvent access control constraints protecting WebSocket endpoints, posing significant risks to application data confidentiality and integrity. The issue specifically impacts Red Hat Enterprise Linux and JBoss Web Server environments where deployed applications configure container-managed security restrictions on WebSocket communication channels. Standard HTTP endpoints and applications that do not utilize WebSocket functionality remain unaffected by this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76183"
},
{
"category": "external",
"summary": "RHBZ#2539355",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539355"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76183",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76183"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76183",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76183"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp",
"url": "https://lists.apache.org/thread/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp"
}
],
"release_date": "2026-09-23T11:16:09.907000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:52:32+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93618"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints"
},
{
"cve": "CVE-2026-77791",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-09-23T13:01:04.663769+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539396"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability occurs when sending a WebSocket close message, which can lead to a busy wait condition. A remote attacker could exploit this to cause a Denial of Service (DoS) by making the server unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an unauthenticated remote client can cause severe CPU starvation and exhaust worker threads without requiring administrative privileges. Exploitation occurs during the termination of WebSocket sessions, forcing the application server into an infinite busy-wait loop that degrades availability for all hosted applications. Deployments are primarily exposed when running web applications that define WebSocket endpoints accessible over untrusted public networks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77791"
},
{
"category": "external",
"summary": "RHBZ#2539396",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539396"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77791",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77791"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77791",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77791"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/mb1pjjooqytrl6hbvbt3rw1lqwlon4cz",
"url": "https://lists.apache.org/thread/mb1pjjooqytrl6hbvbt3rw1lqwlon4cz"
}
],
"release_date": "2026-09-23T11:20:50.457000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:52:32+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93618"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close"
},
{
"cve": "CVE-2026-78383",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-23T15:51:02.902018+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539486"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. An unauthenticated remote attacker can send a specially crafted AJP (Apache JServ Protocol) request, causing an AJP processing thread to become unresponsive. This resource exhaustion can lead to a denial of service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Denial of Service via AJP request",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important impact because an unauthenticated remote attacker can exhaust connector thread pools without authentication, resulting in complete denial of service for the application server. In Red Hat Enterprise Linux and JBoss Web Server environments, the AJP connector is typically disabled by default or bound to loopback interfaces, limiting exposure unless explicitly configured to accept external connections. Consequently, deployments are primarily susceptible when Tomcat services expose AJP listener ports to untrusted networks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-78383"
},
{
"category": "external",
"summary": "RHBZ#2539486",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539486"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-78383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-78383"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78383",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78383"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tyqcqk99g7ghgk22641vf67vghcyswnw",
"url": "https://lists.apache.org/thread/tyqcqk99g7ghgk22641vf67vghcyswnw"
}
],
"release_date": "2026-09-23T11:23:15.477000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:52:32+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93618"
},
{
"category": "workaround",
"details": "This issue can be mitigated by disabling AJP connector or restricting access to it to only trusted AJP clients.",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Apache Tomcat: Denial of Service via AJP request"
},
{
"cve": "CVE-2026-79677",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-09-23T18:23:03.450036+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539616"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by exploiting lost timeouts for asynchronous WebSocket writes. This can lead to the affected system becoming unresponsive or unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-79677"
},
{
"category": "external",
"summary": "RHBZ#2539616",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539616"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-79677",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79677"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-79677",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79677"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/09/23/27",
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/27"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/bzwps6ck4szf2hmksbbon3syyl9qnkv8",
"url": "https://lists.apache.org/thread/bzwps6ck4szf2hmksbbon3syyl9qnkv8"
}
],
"release_date": "2026-09-23T11:28:03.338000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:52:32+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93618"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts"
},
{
"cve": "CVE-2026-86243",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-09-23T12:51:26.320268+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539395"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat Native. A remote attacker can exploit a buffer over-read vulnerability during the Transport Layer Security (TLS) handshake. Successful exploitation causes the Java Virtual Machine (JVM) to crash, resulting in a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Important. An unauthenticated remote attacker can trigger a denial of service by exploiting a buffer over-read in Apache Tomcat Native during the TLS handshake, causing the JVM to crash. The issue affects deployments using vulnerable Tomcat Native versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86243"
},
{
"category": "external",
"summary": "RHBZ#2539395",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539395"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86243"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86243",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86243"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557",
"url": "https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557"
}
],
"release_date": "2026-09-23T12:24:55.119000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:52:32+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93618"
},
{
"category": "workaround",
"details": "Upgrade Apache Tomcat Native to version 1.3.9 or 2.0.16, as appropriate for the version line. For Red Hat JBoss Web Server, apply the corresponding Red Hat update for the affected stream when available. The Apache advisory does not specify an alternate workaround.",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake"
},
{
"cve": "CVE-2026-86246",
"cwe": {
"id": "CWE-1188",
"name": "Initialization of a Resource with an Insecure Default"
},
"discovery_date": "2026-09-23T12:51:12.919296+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539394"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat Native, which enabled several insecure OpenSSL options by default: ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX. These defaults can weaken TLS protections. Apache Tomcat Native versions 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 are affected; the issue is fixed in versions 1.3.9 and 2.0.16.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw Moderate. Apache also rates it Moderate. The issue is caused by insecure OpenSSL options being enabled by default in Apache Tomcat Native.\n\nRed Hat\u0027s CVSS 3.1 score is 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). The CVE record also includes a CISA ADP score of 9.1 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The assessments differ in their evaluation of attack complexity and confidentiality and integrity impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86246"
},
{
"category": "external",
"summary": "RHBZ#2539394",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539394"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86246"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86246",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86246"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5ol",
"url": "https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5ol"
}
],
"release_date": "2026-09-23T12:26:40.789000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:52:32+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93618"
},
{
"category": "workaround",
"details": "Upgrade Apache Tomcat Native to version 1.3.9 or 2.0.16, as applicable. For JBoss Web Server, apply the corresponding Red Hat security update when available. Apache\u2019s advisory does not list an alternative workaround.",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration"
},
{
"cve": "CVE-2026-86247",
"cwe": {
"id": "CWE-366",
"name": "Race Condition within a Thread"
},
"discovery_date": "2026-09-23T12:50:58.696964+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539393"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or reduced security posture.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Moderate severity because successful exploitation requires winning a precise race condition during concurrent TLS handshakes, limiting the predictability of an attack. Impact is restricted to environments where Apache Tomcat Native is explicitly configured to perform mutual TLS and validate client certificates, which is not an active configuration by default in Red Hat JBoss Web Server. An attacker must precisely time multi-threaded connection requests to cause an authentication requirement downgrade.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86247"
},
{
"category": "external",
"summary": "RHBZ#2539393",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539393"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86247"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86247",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86247"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1",
"url": "https://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1"
}
],
"release_date": "2026-09-23T12:31:53.210000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:52:32+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93618"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition"
},
{
"cve": "CVE-2026-86248",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-09-28T22:45:19.239323+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542847"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. When client certificate authentication is configured with strict certificate revocation checking, Online Certificate Status Protocol (OCSP) verification may improperly allow connections instead of failing as intended. A remote attacker presenting an invalid or revoked client certificate could exploit this issue to bypass authentication and gain unauthorized access to protected resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue only affects Tomcat builds with FFM support enabled. In Red Hat Enterprise Linux, this support is only available in Tomcat package in Red Hat Enterprise Linux versions 9.8 and later, and 10.2 and later, as the feature require Java 22 or later.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86248"
},
{
"category": "external",
"summary": "RHBZ#2542847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542847"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86248"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86248",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86248"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/nmkmjp9l53y8h3oc4n8fc0bkw9dv15sk",
"url": "https://lists.apache.org/thread/nmkmjp9l53y8h3oc4n8fc0bkw9dv15sk"
}
],
"release_date": "2026-09-23T11:29:35.479000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:52:32+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93618"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled"
},
{
"cve": "CVE-2026-86350",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-09-23T11:50:57.039780+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2539370"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. This vulnerability, identified as HTTP Request/Response smuggling, stems from an inconsistent interpretation of HTTP/2 requests. A regression in a prior security fix can cause request headers to be mixed up. This could allow a remote attacker to bypass security mechanisms or gain unauthorized access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important impact because unauthenticated remote clients can trigger request desynchronization and header confusion across multiplexed connections, leading to potential access control bypass or data leakage across sessions. Exploitation is limited to instances actively serving HTTP/2 connections, commonly deployed in reverse proxy architectures or direct HTTPS terminations. Instances using standard HTTP/1.1 connector definitions without explicit HTTP/2 protocol upgrade handlers are not exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86350"
},
{
"category": "external",
"summary": "RHBZ#2539370",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539370"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86350"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86350",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86350"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc",
"url": "https://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc"
}
],
"release_date": "2026-09-23T11:31:36.328000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-03T13:52:32+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93618"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.",
"product_ids": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el10jws.src",
"10Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.src",
"10Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el10jws.x86_64",
"10Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"10Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el10jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.src",
"8Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el8jws.x86_64",
"8Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"8Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el8jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-mod_cluster-0:2.1.1-1.Final_redhat_00001.1.el9jws.src",
"9Base-JWS-7.0:jws7-mod_cluster-tomcat-0:2.1.1-1.Final_redhat_00001.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-0:11.0.21-10.redhat_00010.1.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-admin-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-docs-webapp-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-el-5.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-javadoc-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-jsp-3.1-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-lib-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.src",
"9Base-JWS-7.0:jws7-tomcat-native-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-native-debuginfo-0:1.3.7-4.redhat_4.el9jws.x86_64",
"9Base-JWS-7.0:jws7-tomcat-selinux-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-servlet-6.0-api-0:11.0.21-10.redhat_00010.1.el9jws.noarch",
"9Base-JWS-7.0:jws7-tomcat-webapps-0:11.0.21-10.redhat_00010.1.el9jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.