This security update for Tomcat 10 (version 10.1.54) fixes multiple vulnerabilities including CVE-2025-66614, a client certificate verification bypass due to virtual host mapping, and several CVE-2026 vulnerabilities such as request smuggling via invalid chunk extension (CVE-2026-24880), occasional open redirect (CVE-2026-25854), TLS cipher order preservation issues (CVE-2026-29129), OCSP check soft-failures even when disabled (CVE-2026-29145 and CVE-2026-34500), bypass of EncryptInterceptor (CVE-2026-29146 and CVE-2026-34486), incomplete escaping of JSON access logs (CVE-2026-34483), and exposure of Kubernetes bearer tokens in cloud membership for clustering (CVE-2026-34487). The update addresses an incomplete fix for CVE-2025-66614 (CVE-2026-32990). These vulnerabilities affect multiple SUSE and Ubuntu package versions of Tomcat 10. The vendor advisory from Red Hat confirms the availability of fixes and rates the security impact as moderate for their JBoss Web Server product, which includes Tomcat components.

The vulnerabilities fixed include security constraint bypass, client certificate verification bypass, request smuggling, open redirect, improper input validation, and exposure of sensitive tokens. These issues could allow attackers to bypass security controls, manipulate HTTP requests, redirect users to malicious sites, or gain unauthorized access to sensitive information such as Kubernetes bearer tokens. The incomplete fix for CVE-2025-66614 was addressed to prevent continued exploitation. The overall severity is high, indicating significant risk if unpatched.

A security update is available that upgrades Tomcat to version 10.1.54, which includes fixes for all listed vulnerabilities. Users should apply this update promptly. The vendor advisory from Red Hat and SUSE Product Security Team confirms the availability of official fixes. No additional mitigation steps are indicated beyond applying the update. Ensure all previously released errata relevant to your system are applied before updating.