{"schema":"vulnpedia.research/1","cve":"CVE-2026-74049","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://lists.apache.org/thread.html/lolc9wo4tzjog2tnwctv93hz9gjcdnc6","tags":["vendor-advisory","vendor-reference"],"source":"mitre","sourceId":"apache","modified":"2026-10-20T13:37:43.471Z","origins":[{"source":"mitre","sourceId":"apache","modified":"2026-10-20T13:37:43.471Z","url":"https://lists.apache.org/thread.html/lolc9wo4tzjog2tnwctv93hz9gjcdnc6"},{"source":"nvd","sourceId":"CVE-2026-74049","modified":"2026-10-20T19:35:38.940","url":"https://lists.apache.org/thread.html/lolc9wo4tzjog2tnwctv93hz9gjcdnc6"},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://lists.apache.org/thread.html/lolc9wo4tzjog2tnwctv93hz9gjcdnc6"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/22","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-20T18:10:03.349Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-20T18:10:03.349Z","url":"http://www.openwall.com/lists/oss-security/2026/10/20/22"},{"source":"nvd","sourceId":"CVE-2026-74049","modified":"2026-10-20T19:35:38.940","url":"http://www.openwall.com/lists/oss-security/2026/10/20/22"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-74049","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-74049"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556184","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556184"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74049","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-74049"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74049","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74049"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:85926","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:85926"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:81365","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:81365"}]},{"source":"euvd","sourceId":"EUVD-2026-105005","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105005","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-105005","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105005"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat10@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat10-admin-webapps@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat10-common-0:10.1.61-0.1.hum1@noarch@public-hummingbird-s390x-rpms","product":"tomcat10-common-0:10.1.61-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat10-common@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat10-docs-webapp@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat10-jsp-3.1-api@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat10-lib-0:10.1.61-0.1.hum1@noarch@public-hummingbird-s390x-rpms","product":"tomcat10-lib-0:10.1.61-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat10-lib@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat10-servlet-6.0-api@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat10-webapps@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat11-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat11@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat11-admin-webapps@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat11-docs-webapp@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat11-el-6.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms","product":"tomcat11-el-6.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat11-el-6.0-api@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat11-jsp-4.0-api@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat11-servlet-6.1-api@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat11-user-instance-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms","product":"tomcat11-user-instance-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat11-user-instance@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"Red Hat Hardened Images:tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."}],"purl":"pkg:rpm/redhat/tomcat11-webapps@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_enterprise_linux_10:tomcat","product":"tomcat as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_enterprise_linux_10:tomcat-servlet-6.0-api","product":"tomcat-servlet-6.0-api as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-servlet-6.0-api","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_enterprise_linux_10:tomcat9-jsp-2.3-api","product":"tomcat9-jsp-2.3-api as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat9-jsp-2.3-api","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_enterprise_linux_6:tomcat6-admin-webapps","product":"tomcat6-admin-webapps as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat6-admin-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_enterprise_linux_6:tomcat6-log4j","product":"tomcat6-log4j as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat6-log4j","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_enterprise_linux_7:tomcat-el-2.2-api","product":"tomcat-el-2.2-api as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-el-2.2-api","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_enterprise_linux_7:tomcat-webapps","product":"tomcat-webapps as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_enterprise_linux_8:tomcat-admin-webapps","product":"tomcat-admin-webapps as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-admin-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_enterprise_linux_8:tomcat.src","product":"tomcat.src as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_enterprise_linux_9:tomcat-docs-webapp","product":"tomcat-docs-webapp as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-docs-webapp","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat","product":"jws5-tomcat as a component of Red Hat JBoss Web Server 5","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws5-tomcat","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat-javadoc","product":"jws5-tomcat-javadoc as a component of Red Hat JBoss Web Server 5","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws5-tomcat-javadoc","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat-webapps","product":"jws5-tomcat-webapps as a component of Red Hat JBoss Web Server 5","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws5-tomcat-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_jboss_web_server_6:jws6-tomcat-jsp-3.1-api","product":"jws6-tomcat-jsp-3.1-api as a component of Red Hat JBoss Web Server 6","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws6-tomcat-jsp-3.1-api","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_jboss_web_server_7:jws7-tomcat.src","product":"jws7-tomcat.src as a component of Red Hat JBoss Web Server 7","status":"known_affected","remediations":[{"category":"workaround","details":"Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws7-tomcat?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]},{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json","productId":"red_hat_hardened_images:hi/tomcat","product":"hi/tomcat as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/tomcat?repository_url=registry.redhat.io/hi/tomcat","origins":[{"source":"redhat","sourceId":"CVE-2026-74049","modified":"2026-10-22T21:20:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74049.json"}]}],"vendorCoverage":{"total":153,"shown":32,"omitted":121,"source":"redhat"}}