The advisory updates Red Hat Hardened Images RPMs, including multiple tomcat10 packages to version 10.1.56-1.hum1, addressing several CVEs including CVE-2026-55955. This CVE describes an improper authentication vulnerability in Apache Tomcat's EncryptionInterceptor used for Tribes cluster communication, enabling a replay attack on encrypted cluster messages. Exploitation requires the EncryptionInterceptor to be configured (a non-default setting) and attacker access to the cluster network. Red Hat adjusted the severity to moderate (CVSS 3.1 vector AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, score 4.2) reflecting the limited attack surface. The advisory includes no explicit patch links but references updated package versions. No known exploits in the wild are reported.

The vulnerabilities fixed by this update could allow unauthorized access or manipulation of data within Tomcat clusters if the EncryptionInterceptor is enabled and the attacker has access to the cluster network. The impact is limited to specific configurations (non-default clustering with EncryptionInterceptor). Red Hat rates the severity as moderate for CVE-2026-55955, with low confidentiality and integrity impact and no availability impact. Other CVEs addressed are not detailed here but are included in the update. There are no known active exploits.

Red Hat has released updated tomcat10 RPM packages (version 10.1.56-1.hum1) that fix these vulnerabilities. Users should apply these updates to affected Red Hat Hardened Images. For CVE-2026-55955, only deployments using the EncryptionInterceptor for Tribes cluster communication are affected; restricting cluster communication to trusted, isolated networks mitigates risk. Deployments not using this configuration are not affected. No other specific mitigations are indicated.