[1:9.0.120-1] - Resolves: RHEL-192825 HTTP/2 request headers not validated (CVE-2026-41293) - Resolves: RHEL-192659 Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) - Resolves: RHEL-219565 Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) - Resolves: RHEL-219573 Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084) - Resolves: RHEL-238189 tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498) - Resolves: RHEL-238247 tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) - Resolves: RHEL-238277 tomcat: Improper Authorization allows security bypass (CVE-2026-43515) - Resolves: RHEL-238302 tomcat: Authentication bypass via digest authentication (CVE-2026-43512) - Related: RHEL-183992 Remove tomcat clustering JAR from RPM builds [1:9.0.110-1] - Resolves: RHEL-148687 Update to 9....

Read the Full Advisory

http://oss.oracle.com/ol9/SRPMS-updates/tomcat-9.0.120-2.el9_8.src.rpm

tomcat-9.0.120-2.el9_8.noarch.rpm tomcat-admin-webapps-9.0.120-2.el9_8.noarch.rpm tomcat-docs-webapp-9.0.120-2.el9_8.noarch.rpm tomcat-el-3.0-api-9.0.120-2.el9_8.noarch.rpm tomcat-jsp-2.3-api-9.0.120-2.el9_8.noarch.rpm tomcat-lib-9.0.120-2.el9_8.noarch.rpm tomcat-servlet-4.0-api-9.0.120-2.el9_8.noarch.rpm tomcat-webapps-9.0.120-2.el9_8.noarch.rpm

tomcat-9.0.120-2.el9_8.noarch.rpm tomcat-admin-webapps-9.0.120-2.el9_8.noarch.rpm tomcat-docs-webapp-9.0.120-2.el9_8.noarch.rpm tomcat-el-3.0-api-9.0.120-2.el9_8.noarch.rpm tomcat-jsp-2.3-api-9.0.120-2.el9_8.noarch.rpm tomcat-lib-9.0.120-2.el9_8.noarch.rpm tomcat-servlet-4.0-api-9.0.120-2.el9_8.noarch.rpm tomcat-webapps-9.0.120-2.el9_8.noarch.rpm