{"schema":"vulnpedia.research/1","cve":"CVE-2026-74048","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://lists.apache.org/thread.html/v5ry0sx1c7x1wr5mx4cddj3p3mv1ho6m","tags":["vendor-advisory","vendor-reference"],"source":"mitre","sourceId":"apache","modified":"2026-10-20T13:36:36.859Z","origins":[{"source":"mitre","sourceId":"apache","modified":"2026-10-20T13:36:36.859Z","url":"https://lists.apache.org/thread.html/v5ry0sx1c7x1wr5mx4cddj3p3mv1ho6m"},{"source":"nvd","sourceId":"CVE-2026-74048","modified":"2026-10-20T19:35:38.940","url":"https://lists.apache.org/thread.html/v5ry0sx1c7x1wr5mx4cddj3p3mv1ho6m"},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://lists.apache.org/thread.html/v5ry0sx1c7x1wr5mx4cddj3p3mv1ho6m"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/21","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-20T18:10:02.410Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-20T18:10:02.410Z","url":"http://www.openwall.com/lists/oss-security/2026/10/20/21"},{"source":"nvd","sourceId":"CVE-2026-74048","modified":"2026-10-20T19:35:38.940","url":"http://www.openwall.com/lists/oss-security/2026/10/20/21"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-74048","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-74048"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556185","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556185"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74048","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-74048"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74048","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74048"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:85926","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://access.redhat.com/errata/RHSA-2026:85926"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:81365","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://access.redhat.com/errata/RHSA-2026:81365"}]},{"source":"euvd","sourceId":"EUVD-2026-105004","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105004","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-105004","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105004"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"Red Hat Hardened Images:tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."}],"purl":"pkg:rpm/redhat/tomcat10@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."}],"purl":"pkg:rpm/redhat/tomcat10-admin-webapps@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."}],"purl":"pkg:rpm/redhat/tomcat10-docs-webapp@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."}],"purl":"pkg:rpm/redhat/tomcat10-jsp-3.1-api@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."}],"purl":"pkg:rpm/redhat/tomcat10-servlet-6.0-api@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"Red Hat Hardened Images:tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."}],"purl":"pkg:rpm/redhat/tomcat10-webapps@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"Red Hat Hardened Images:tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."}],"purl":"pkg:rpm/redhat/tomcat11-admin-webapps@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"Red Hat Hardened Images:tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."}],"purl":"pkg:rpm/redhat/tomcat11-docs-webapp@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"Red Hat Hardened Images:tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."}],"purl":"pkg:rpm/redhat/tomcat11-jsp-4.0-api@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"Red Hat Hardened Images:tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."}],"purl":"pkg:rpm/redhat/tomcat11-servlet-6.1-api@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"Red Hat Hardened Images:tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."}],"purl":"pkg:rpm/redhat/tomcat11-webapps@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_10:tomcat","product":"tomcat as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_10:tomcat-lib","product":"tomcat-lib as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-lib","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_10:tomcat9","product":"tomcat9 as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat9","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_10:tomcat9-lib","product":"tomcat9-lib as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat9-lib","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_8:tomcat-admin-webapps","product":"tomcat-admin-webapps as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-admin-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_8:tomcat-servlet-4.0-api","product":"tomcat-servlet-4.0-api as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-servlet-4.0-api","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_9:tomcat-admin-webapps","product":"tomcat-admin-webapps as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-admin-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_9:tomcat-servlet-4.0-api","product":"tomcat-servlet-4.0-api as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-servlet-4.0-api","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_jboss_web_server_6:jws6-tomcat-docs-webapp","product":"jws6-tomcat-docs-webapp as a component of Red Hat JBoss Web Server 6","status":"known_affected","remediations":[{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws6-tomcat-docs-webapp","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_jboss_web_server_6:jws6-tomcat-lib","product":"jws6-tomcat-lib as a component of Red Hat JBoss Web Server 6","status":"known_affected","remediations":[{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws6-tomcat-lib","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_jboss_web_server_7:jws7-tomcat.src","product":"jws7-tomcat.src as a component of Red Hat JBoss Web Server 7","status":"known_affected","remediations":[{"category":"workaround","details":"Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws7-tomcat?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_6:tomcat6","product":"tomcat6 as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat6","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_6:tomcat6-jsp-2.1-api","product":"tomcat6-jsp-2.1-api as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat6-jsp-2.1-api","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_6:tomcat6-webapps","product":"tomcat6-webapps as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat6-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_7:tomcat-el-2.2-api","product":"tomcat-el-2.2-api as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat-el-2.2-api","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_7:tomcat-servlet-3.0-api","product":"tomcat-servlet-3.0-api as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/tomcat-servlet-3.0-api","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_enterprise_linux_8:pki-servlet-engine.src::pki-deps:10.6","product":"pki-servlet-engine.src (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/pki-servlet-engine?arch=src&rpmmod=pki-deps:10.6","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_hardened_images:hi/tomcat","product":"hi/tomcat as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/tomcat?repository_url=registry.redhat.io/hi/tomcat","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat-java-jdk11","product":"jws5-tomcat-java-jdk11 as a component of Red Hat JBoss Web Server 5","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws5-tomcat-java-jdk11","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat-jsvc","product":"jws5-tomcat-jsvc as a component of Red Hat JBoss Web Server 5","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws5-tomcat-jsvc","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]},{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat.src","product":"jws5-tomcat.src as a component of Red Hat JBoss Web Server 5","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/jws5-tomcat?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-74048","modified":"2026-10-21T19:44:04+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74048.json"}]}],"vendorCoverage":{"total":153,"shown":32,"omitted":121,"source":"redhat"}}