The Red Hat security advisory RHSA-2026:0292 reports two vulnerabilities in Apache Tomcat components used in the pki-servlet-engine package on Red Hat Enterprise Linux 9.0. CVE-2025-31651 allows bypassing of rules in the Rewrite Valve, potentially undermining URL rewriting security controls. CVE-2025-55752 is a directory traversal vulnerability via rewrite rules that could enable remote code execution. These vulnerabilities affect the Tomcat servlet engine implementation and have been addressed by Red Hat in updated pki-servlet-engine packages (version 9.0.43-4.el9_0.2). The advisory references fixes for these issues and provides package updates for multiple architectures including x86_64, ppc64le, aarch64, and s390x. No CVSS scores are provided, but the impact is rated Important by Red Hat.

Successful exploitation of CVE-2025-31651 could allow attackers to bypass URL rewrite rules, potentially enabling unauthorized access or manipulation of web application behavior. CVE-2025-55752 could allow directory traversal attacks via rewrite rules, which may lead to remote code execution on affected systems. These vulnerabilities could compromise the confidentiality, integrity, and availability of affected systems running the vulnerable Tomcat servlet engine within Red Hat Enterprise Linux 9.0's pki-servlet-engine. No known exploits in the wild have been reported at this time.

Red Hat has released updated pki-servlet-engine packages (version 9.0.43-4.el9_0.2) that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions should apply these updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified in the advisory. Patch status is official-fix as per the Red Hat advisory RHSA-2026:0292.