The Red Hat security advisory RHSA-2026:2725 updates the pki-deps:10.6 module to address two Apache Tomcat vulnerabilities. CVE-2025-31651 involves a bypass of rules in the Rewrite Valve, potentially allowing unintended request handling. CVE-2025-55752 is a directory traversal vulnerability via rewrite rules that may lead to remote code execution. These vulnerabilities affect the Apache Tomcat components used within the Red Hat Certificate System on Red Hat Enterprise Linux 8.2 AUS. The advisory recommends applying the update after ensuring all prior errata are applied. No detailed CVSS scores are provided, but the impact is rated as Important by Red Hat Product Security.

Successful exploitation of CVE-2025-31651 could allow bypassing of rewrite rules in Apache Tomcat, potentially enabling unauthorized request processing. CVE-2025-55752 could allow an attacker to perform directory traversal via rewrite rules, which may lead to remote code execution on affected systems. These vulnerabilities impact the security of the Red Hat Certificate System and could compromise system integrity and confidentiality if exploited.

Red Hat has released an updated pki-deps:10.6 module for Red Hat Enterprise Linux 8.2 AUS that addresses these vulnerabilities. Users should apply this security update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. No indication of alternative mitigations or workarounds is provided, so applying the official update is the recommended remediation.