Red Hat Product Security issued an advisory for Apache Tomcat vulnerabilities affecting Red Hat Enterprise Linux 9. The fixed issues are: CVE-2025-46701, a security constraint bypass for CGI scripts; CVE-2025-55668, session fixation via the rewrite valve; and CVE-2025-55754, console manipulation. These vulnerabilities impact the Tomcat servlet container and related components. The advisory includes updated Tomcat packages for multiple architectures and variants of Red Hat Enterprise Linux 9. The update rebases the Tomcat package and enables post-quantum cryptography features. No CVSS scores are provided in the advisory, but the overall security impact is rated Important.

The vulnerabilities could allow attackers to bypass security constraints on CGI scripts, fixate sessions via the rewrite valve, or manipulate the console, potentially leading to unauthorized access or session hijacking. The advisory does not report known exploits in the wild. The impact is considered significant enough to warrant an Important severity rating by Red Hat, indicating a high risk to affected systems if unpatched.

Red Hat has released updated Tomcat packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply these official updates as described in the Red Hat advisory (RHSA-2026:18916) and the referenced article https://access.redhat.com/articles/11258. Since this is an on-premises product, remediation requires system administrators to update the affected packages. No alternative mitigations or workarounds are specified in the advisory.