Symbolic Name not Mapping to Correct Object Affecting jws7-tomcat-el-5.0-api package, versions <0:11.0.21-7.redhat_00006.1.el10jws


Severity

Recommended
0.0
low
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.43% (36th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-JWS7TOMCATEL50API-20567053
  • published8 Oct 2026
  • disclosed25 Aug 2026

Introduced: 25 Aug 2026

CVE-2026-66422  (opens in a new tab)
CWE-386  (opens in a new tab)

How to fix?

Upgrade RHEL:10 jws7-tomcat-el-5.0-api to version 0:11.0.21-7.redhat_00006.1.el10jws or higher.
This issue was patched in RHSA-2026:76952.

NVD Description

Note: Versions mentioned in the description apply only to the upstream jws7-tomcat-el-5.0-api package and not the jws7-tomcat-el-5.0-api package as distributed by RHEL. See How to fix? for RHEL:10 relevant fixed versions and status.

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

CVSS Base Scores

version 3.1