Red Hat Product Security has issued an important security update for Apache Tomcat in Red Hat Enterprise Linux 9 to address three vulnerabilities: CVE-2025-46701 (security constraint bypass for CGI scripts), CVE-2025-55668 (session fixation via rewrite valve), and CVE-2025-55754 (console manipulation). These vulnerabilities affect the Tomcat servlet container and related components. The advisory references updated packages (e.g., tomcat-9.0.110-2.el9_8) that include fixes for these issues. The update applies to multiple architectures and variants of Red Hat Enterprise Linux 9. No CVSS scores are provided in the advisory, but the update is classified as Important.

The vulnerabilities could allow attackers to bypass security constraints on CGI scripts, perform session fixation attacks via the rewrite valve, and manipulate the console, potentially leading to unauthorized access or control within the Tomcat environment. The advisory does not report known exploits in the wild. The impact is rated as Important by Red Hat, indicating a significant security risk if unpatched.

Red Hat has released updated Tomcat packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory (RHSA-2026:18916) and the referenced article https://access.redhat.com/articles/11258. Applying the official patch is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.