This Red Hat security advisory (RHSA-2026:13745) covers a bug fix and enhancement update for Red Hat Hardened Images RPMs, including multiple Apache Tomcat 11 packages. Among the addressed vulnerabilities is CVE-2026-43512, which allows an authentication bypass via DIGEST authentication due to improper handling of unknown users with the password 'null'. The unknown user does not gain roles or impersonate existing users, limiting the impact. Red Hat notes that DIGEST authentication is not commonly enabled by default in production environments. No explicit patch links are provided, but updated RPM versions (tomcat11-11.0.22-0.1.hum1) are available. Other CVEs addressed include CVE-2026-42498, CVE-2026-43514, and CVE-2026-43515. No known exploits in the wild are reported.

The primary impact is an authentication bypass under specific conditions when DIGEST authentication is enabled in Apache Tomcat 11. An attacker can authenticate as an unknown user by supplying the password 'null'. However, since this unknown user is not associated with any valid roles, the attacker's access remains limited by application authorization constraints. There is no credential theft or impersonation of existing users. The overall impact is medium severity due to the limited scope and the uncommon use of DIGEST authentication in production.

Red Hat recommends disabling DIGEST authentication in Apache Tomcat if it is not essential to the environment. This involves modifying the server's authentication configuration to use alternative methods and restarting the service. Applying the updated RPM packages provided in the advisory will address the vulnerabilities. Since this is a security advisory with updated RPMs, a fix is available through these package updates. Users should refer to https://images.redhat.com/ for details on applying the update.