Red Hat Product Security issued an advisory (RHSA-2026:0293) for the pki-servlet-engine package in Red Hat Enterprise Linux 9.2, addressing two Apache Tomcat vulnerabilities: CVE-2025-31651, a bypass of rules in the Rewrite Valve, and CVE-2025-55752, a directory traversal vulnerability via rewrite that could potentially allow remote code execution. These vulnerabilities affect the servlet engine used in the official Java Servlet and JavaServer Pages Reference Implementation. The update to pki-servlet-engine version 9.0.50-1.el9_2.3 includes fixes for these issues. The advisory rates the impact as Important (high severity) but does not provide a CVSS score. The update is available for various architectures including x86_64, ppc64le, aarch64, and s390x. The vendor advisory provides detailed package information and references for remediation.

Successful exploitation of CVE-2025-31651 could allow bypassing of rewrite rules in Apache Tomcat's Rewrite Valve, potentially enabling unauthorized request handling. CVE-2025-55752 could allow directory traversal via rewrite rules, which may lead to remote code execution on affected systems. These vulnerabilities pose a high security risk as they could compromise the integrity and security of applications running on the affected servlet engine. No known exploits in the wild have been reported so far.

Red Hat has released an official security update for the pki-servlet-engine package (version 9.0.50-1.el9_2.3) that addresses these vulnerabilities. Users of Red Hat Enterprise Linux 9.2 should apply this update promptly to remediate the issues. Detailed instructions for applying the update are available in the Red Hat advisory (RHSA-2026:0293) and related documentation at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.