Red Hat Tomcat 9.0.121 and 10.1.49 Fix Security Flaws
Tech GuruQuick Answer
Red Hat issued Tomcat 9.0.121 and 10.1.49 security updates across supported RHEL extended streams. Inventory application servers and exact repositories, install the matching package, restart workloads, validate applications and connectors, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Tomcat servers, exact 9 or 10 branches, RHEL 9.2, 9.4, 9.6 or 10.0 streams, deployed applications, connectors, owners, and maintenance windows. Match the Tomcat and RHEL branch to its RHSA; do not cross-install packages or infer every CVE affects every connector and application. Install the matching signed Tomcat 9.0.121 or 10.1.49 package from the correct Red Hat repository and restart the service so fixed classes load. Confirm package and running process versions, test authentication, HTTP connectors, sessions and representative applications, review errors, and retain evidence.
Last verified: 2026-10-30 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat Tomcat on RHEL 9.2, 9.4, 9.6, and 10.0 extended streams |
|---|---|
| Advisory | RHSA-2026:92863 / RHSA-2026:92870 / RHSA-2026:92871 / RHSA-2026:92872 |
| CVEs | CVE-2026-65182, CVE-2026-65637, CVE-2026-65905, CVE-2026-65927, CVE-2026-68525, CVE-2026-68569, CVE-2026-68763 |
| Authoritative release date | 2026-10-29 22:27:59 UTC |
| Authority revision date | 2026-10-30 00:51:54 UTC |
| Affected versions | Advisory-listed packages on Red Hat Enterprise Linux AppStream E4S (v.9.2); Red Hat Enterprise Linux AppStream E4S (v.9.4); Red Hat Enterprise Linux AppStream EUS (v. 10.0); Red Hat Enterprise Linux AppStream EUS (v.9.6), before the exact fixed builds in the corresponding RHSA. |
| Fixed version | tomcat-1:10.1.49-2.el10_0.src; tomcat-1:9.0.121-1.el9_2.src; tomcat-1:9.0.121-1.el9_4.src; tomcat-1:9.0.121-1.el9_6.src |
| CVSS base score | 4.8-8.2 (CVSS v3.1; advisory-specific) |
| CVSS severity | Medium to High |
| Exploitation status | Red Hat does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Four errata update Tomcat 9 and 10 across the listed RHEL extended-support streams. Red Hat rates the grouped errata Important; individual CVSS scores and prerequisites differ by CVE.
What To Validate Now
- Inventory. Inventory Tomcat servers, exact 9 or 10 branches, RHEL 9.2, 9.4, 9.6 or 10.0 streams, deployed applications, connectors, owners, and maintenance windows.
- Establish applicability. Match the Tomcat and RHEL branch to its RHSA; do not cross-install packages or infer every CVE affects every connector and application.
- Remediate. Install the matching signed Tomcat 9.0.121 or 10.1.49 package from the correct Red Hat repository and restart the service so fixed classes load.
- Validate. Confirm package and running process versions, test authentication, HTTP connectors, sessions and representative applications, review errors, and retain evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Tomcat updates and restarts can interrupt stateful applications and expose compatibility problems. Back up configuration, stage critical workloads, and preserve rollback.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
