The advisory updates multiple tomcat11 RPM packages in Red Hat Hardened Images to address several security vulnerabilities, including CVE-2026-55955, which is an improper authentication vulnerability in Apache Tomcat's EncryptionInterceptor component used for Tribes cluster communication. This flaw allows a remote attacker to perform a replay attack on encrypted cluster messages, potentially leading to unauthorized access or data manipulation within the cluster. Exploitation requires the EncryptionInterceptor to be configured (a non-default setting) and attacker access to the cluster network. Red Hat has adjusted the severity of this vulnerability to moderate (CVSS 3.1 vector: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) due to the limited attack surface. The advisory includes updates to tomcat11 packages at version 11.0.23-0.1.hum1 (noarch) and related components. No explicit patch links were provided, but the advisory references updated RPMs available via Red Hat's repositories.

The vulnerabilities addressed could allow unauthorized access or manipulation of data within Tomcat clusters if the EncryptionInterceptor is used for Tribes cluster communication. Since this configuration is non-default and requires attacker access to the cluster network, the overall impact is limited to specific deployment scenarios. Other included CVEs address various security issues in the tomcat11 RPMs. The advisory rates the overall severity as critical, but the specific EncryptionInterceptor vulnerability is considered moderate by Red Hat. There are no known exploits in the wild at this time.

Red Hat has released updated tomcat11 RPM packages (version 11.0.23-0.1.hum1) that include fixes for the described vulnerabilities. Users should apply these updates to affected Red Hat Hardened Images to remediate the issues. For the EncryptionInterceptor vulnerability, mitigation includes ensuring that cluster communication channels are restricted to trusted, isolated networks and avoiding use of the EncryptionInterceptor unless necessary. Deployments not using Tomcat clustering or not configuring the EncryptionInterceptor are not affected. Since this is an RPM update, applying the vendor-provided packages is the recommended remediation.