The Red Hat security advisory RHSA-2026:2725 addresses two vulnerabilities in Apache Tomcat components used within the PKI Core packages of Red Hat Certificate System. CVE-2025-31651 involves a bypass of rules in the Rewrite Valve, and CVE-2025-55752 involves directory traversal via rewrite that could lead to remote code execution. These vulnerabilities affect Red Hat Enterprise Linux 8.2 AUS with the pki-deps:10.6 module. The advisory provides an update to remediate these issues and recommends applying this update after ensuring all previous errata are applied. No CVSS base scores are included in the advisory, and no known exploits in the wild have been reported.

Successful exploitation of CVE-2025-31651 could allow bypassing of rewrite rules in Apache Tomcat, potentially undermining intended access controls. CVE-2025-55752 could allow directory traversal via rewrite rules, which may lead to remote code execution, posing a significant risk to system integrity and confidentiality. The advisory rates the overall impact as Important, indicating a high security risk if unpatched. No known exploits in the wild have been reported at this time.

Red Hat has released a security update for the pki-deps:10.6 module addressing these vulnerabilities. Users should apply this update on Red Hat Enterprise Linux 8.2 AUS systems after ensuring all previously released relevant errata have been applied. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified in the advisory.