The Red Hat security advisory RHSA-2026:2726 reports two vulnerabilities affecting the pki-deps:10.6 module used in Red Hat Enterprise Linux 8.6. The first vulnerability (CVE-2025-31651) is a bypass of rules in the Apache Tomcat Rewrite Valve. The second (CVE-2025-55752) is a directory traversal vulnerability via rewrite in Apache Tomcat's tomcat-catalina component, which may lead to remote code execution. These vulnerabilities impact fundamental PKI Core packages required by the Red Hat Certificate System. The advisory provides updated packages to remediate these issues and directs users to apply the update as per Red Hat guidance. No CVSS base scores are included in the advisory, but the severity is rated as Important by Red Hat Product Security.

Successful exploitation of CVE-2025-31651 could allow bypassing of rewrite rules in Apache Tomcat, potentially enabling unauthorized access or manipulation of web traffic. CVE-2025-55752 could allow directory traversal attacks via rewrite rules, with the possibility of remote code execution, posing a significant risk to system integrity and confidentiality. These vulnerabilities affect core PKI components, which are critical for certificate management and security services in Red Hat Enterprise Linux 8.6 environments.

Red Hat has released updated packages for the pki-deps:10.6 module that address these vulnerabilities. Users should apply the security update RHSA-2026:2726 promptly following Red Hat's official guidance at https://access.redhat.com/articles/11258. Since this is a traditional software update (not a cloud service), remediation requires manual or automated patch deployment by system administrators. No indication is given that no action is required or that the issue is already mitigated without patching.