This advisory covers three security vulnerabilities in Apache Tomcat 9 as packaged in Red Hat Enterprise Linux 10. CVE-2025-46701 involves a security constraint bypass affecting CGI scripts. CVE-2025-55668 is a session fixation vulnerability via the rewrite valve component. CVE-2025-55754 concerns console manipulation issues in the tomcat-juli component. Red Hat has released an updated tomcat9 package (version 9.0.110-2.el10_2) that addresses these vulnerabilities. The advisory references Red Hat Enterprise Linux 10 Release Notes for additional changes and provides links for applying the update. No CVSS scores are provided in the advisory, but the update is rated as important.

Successful exploitation of these vulnerabilities could allow an attacker to bypass security constraints on CGI scripts, fixate sessions via the rewrite valve potentially leading to session hijacking, or manipulate the console, which could impact the integrity and security of the Tomcat server environment. These issues affect the security posture of applications running on the affected Tomcat version in Red Hat Enterprise Linux 10.

A security update for tomcat9 is available for Red Hat Enterprise Linux 10 and should be applied to affected systems. The updated package version is 9.0.110-2.el10_2. Administrators should follow Red Hat's official guidance for applying this update as detailed in the advisory and linked articles. No additional mitigation steps are indicated beyond applying the provided update.