Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Apache Tomcat: Unauthenticated Remote Code Execution

published 5 months ago

Summary

Apache Tomcat users should update their software to fix a security issue that could allow hackers to run malicious code on a server without needing a password. This could lead to unauthorized access and data theft. Users should apply the latest security patches as soon as possible.

What to do

Update redhat tomcat to version 1:10.1.49-1.el10_2.1.
Update redhat tomcat-admin-webapps to version 1:10.1.49-1.el10_2.1.
Update redhat tomcat-docs-webapp to version 1:10.1.49-1.el10_2.1.
Update redhat tomcat-el-5.0-api to version 1:10.1.49-1.el10_2.1.
Update redhat tomcat-jsp-3.1-api to version 1:10.1.49-1.el10_2.1.
Update redhat tomcat-lib to version 1:10.1.49-1.el10_2.1.
Update redhat tomcat-servlet-6.0-api to version 1:10.1.49-1.el10_2.1.
Update redhat tomcat-webapps to version 1:10.1.49-1.el10_2.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:10.2	redhat	tomcat	< 1:10.1.49-1.el10_2.1 Fix: upgrade to 1:10.1.49-1.el10_2.1
Red Hat:enterprise_linux:10.2	redhat	tomcat-admin-webapps	< 1:10.1.49-1.el10_2.1 Fix: upgrade to 1:10.1.49-1.el10_2.1
Red Hat:enterprise_linux:10.2	redhat	tomcat-docs-webapp	< 1:10.1.49-1.el10_2.1 Fix: upgrade to 1:10.1.49-1.el10_2.1
Red Hat:enterprise_linux:10.2	redhat	tomcat-el-5.0-api	< 1:10.1.49-1.el10_2.1 Fix: upgrade to 1:10.1.49-1.el10_2.1
Red Hat:enterprise_linux:10.2	redhat	tomcat-jsp-3.1-api	< 1:10.1.49-1.el10_2.1 Fix: upgrade to 1:10.1.49-1.el10_2.1
Red Hat:enterprise_linux:10.2	redhat	tomcat-lib	< 1:10.1.49-1.el10_2.1 Fix: upgrade to 1:10.1.49-1.el10_2.1
Red Hat:enterprise_linux:10.2	redhat	tomcat-servlet-6.0-api	< 1:10.1.49-1.el10_2.1 Fix: upgrade to 1:10.1.49-1.el10_2.1
Red Hat:enterprise_linux:10.2	redhat	tomcat-webapps	< 1:10.1.49-1.el10_2.1 Fix: upgrade to 1:10.1.49-1.el10_2.1

Original advisory text

Red Hat Security Advisory: tomcat security update

References

https://access.redhat.com/errata/RHSA-2026:19054 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2440426 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19054.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-24734 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-24734 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-24734 Vendor Advisory
https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

7.4 High

Timeline

Published20 May 2026

Updated17 Jun 2026

First seen17 Jun 2026

Sources

RHSA-2026:19054 · OSV

Track software like this

Free during beta