jws7-tomcat-admin-webapps vulnerabilities (Red Hat)
25 vulnerabilities.
-
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Principal lookup can fail open in some cases 8.1 High -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Authenticated WebSocket session survives end of HTTP session 6.8 Medium -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset 7.5 High -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Redirect after FORM auth may bypass method specific constraints 9.1 Critical -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Servlet role references can bypass declarative role constraints 8.1 High -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control 7.5 High -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Limited replay attack possible with DIGEST authentication 9.8 Critical -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete 9.8 Critical -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets 8.1 High -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Bypass longest prefix security constraint 9.1 Critical -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: DoS via WebSocket chat example 5.3 Medium -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass 9.1 Critical -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Security constraints for default servlet ignored method 6.5 Medium -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Logged effective web.xml is incomplete 9.1 Critical -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector 9.1 Critical -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Bad ornext processing in RewriteValve 7.3 High -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Security constraints not correctly applied 9.1 Critical -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: AJP secret compared in non-constant time 3.7 Low -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: LockOutRealm treats user names as case-sensitive 7.5 High -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Digest authenticator will authenticate any unknown user 9.8 Critical -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: HTTP/2 request headers not validated 9.8 Critical -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: WebSocket authentication header exposure 7.3 High -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling 7.5 High -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor 7.5 High -
jws7-tomcat-admin-webappsRed Hat Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default 7.5 High