diff --git a/.gitignore b/.gitignore
index d347a63..ad2b66c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-tomcat-10.1.49.redhat-00007-src.zip
+tomcat-10.1.49.redhat-00011-src.zip
diff --git a/rhbz-1857043.patch b/rhbz-1857043.patch
index 31ca1df..055d918 100644
--- a/rhbz-1857043.patch
+++ b/rhbz-1857043.patch
@@ -1,21 +1,21 @@
 --- build.xml.orig
 +++ build.xml
-@@ -1124,7 +1124,7 @@
+@@ -1138,7 +1138,7 @@
        filesDir="${tomcat.classes}"
        filesId="files.annotations-api"
        manifest="${tomcat.manifests}/annotations-api.jar.manifest"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- Servlet Implementation JAR File -->
      <jarIt jarfile="${servlet-api.jar}"
-@@ -1133,48 +1133,48 @@
+@@ -1147,48 +1147,48 @@
        manifest="${tomcat.manifests}/servlet-api.jar.manifest"
        notice="${tomcat.manifests}/servlet-api.jar.notice"
        license="${tomcat.manifests}/servlet-api.jar.license"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- EL Implementation JAR File -->
      <jarIt jarfile="${el-api.jar}"
        filesDir="${tomcat.classes}"
@@ -23,7 +23,7 @@
        manifest="${tomcat.manifests}/el-api.jar.manifest"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- JSP Implementation JAR File -->
      <jarIt jarfile="${jsp-api.jar}"
        filesDir="${tomcat.classes}"
@@ -31,7 +31,7 @@
        manifest="${tomcat.manifests}/jsp-api.jar.manifest"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- WebSocket API JAR File -->
      <jarIt jarfile="${websocket-api.jar}"
        filesDir="${tomcat.classes}"
@@ -39,7 +39,7 @@
        manifest="${tomcat.manifests}/websocket-api.jar.manifest"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- WebSocket Client API JAR File -->
      <jarIt jarfile="${websocket-client-api.jar}"
        filesDir="${tomcat.classes}"
@@ -47,7 +47,7 @@
        manifest="${tomcat.manifests}/websocket-client-api.jar.manifest"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- JASPIC API JAR File -->
      <jarIt jarfile="${jaspic-api.jar}"
        filesDir="${tomcat.classes}"
@@ -55,50 +55,50 @@
        manifest="${tomcat.manifests}/jaspic-api.jar.manifest"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- Tomcat-juli JAR File -->
      <jarIt jarfile="${tomcat-juli.jar}"
        filesDir="${tomcat.classes}"
        filesId="files.tomcat-juli"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- Bootstrap JAR File -->
      <jarIt jarfile="${bootstrap.jar}"
-@@ -1186,68 +1186,68 @@
+@@ -1200,44 +1200,44 @@
      <jarIt jarfile="${tomcat-util.jar}"
        filesDir="${tomcat.classes}"
        filesId="files.tomcat-util"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- Tomcat API JAR File -->
      <jarIt jarfile="${tomcat-api.jar}"
        filesDir="${tomcat.classes}"
        filesId="files.tomcat-api"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- Tomcat Util Scan JAR File -->
      <jarIt jarfile="${tomcat-util-scan.jar}"
        filesDir="${tomcat.classes}"
        filesId="files.tomcat-util-scan"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <jarIt jarfile="${tomcat-jni.jar}"
        filesDir="${tomcat.classes}"
        filesId="files.tomcat-jni"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- Protocol handlers - Coyote -->
      <jarIt jarfile="${tomcat-coyote.jar}"
        filesDir="${tomcat.classes}"
        filesId="files.tomcat-coyote"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- OpenSSL FFM - Coyote -->
      <jarIt jarfile="${tomcat-coyote-ffm.jar}"
        filesDir="${tomcat.classes}"
@@ -106,7 +106,7 @@
        manifest="${tomcat.manifests}/tomcat-coyote-ffm.jar.manifest"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- WebSocket implementation JAR File -->
      <jarIt jarfile="${tomcat-websocket.jar}"
        filesDir="${tomcat.classes}"
@@ -114,44 +114,34 @@
        meta-inf="${tomcat.manifests}/tomcat-websocket.jar"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
-     <!-- Catalina GroupCom/Tribes JAR File -->
-     <jarIt jarfile="${catalina-tribes.jar}"
-       filesDir="${tomcat.classes}"
-       filesId="files.catalina-tribes"
--      addOSGi="true" />
-+      addOSGi="false" />
- 
-     <!-- Catalina Main JAR File -->
+
+     <!-- Catalina GroupCom/Tribes JAR File - STUB for JWS-3904 -->
+     <jar destfile="${catalina-tribes.jar}">
+@@ -1258,7 +1258,7 @@
      <jarIt jarfile="${catalina.jar}"
        filesDir="${tomcat.classes}"
        filesId="files.catalina"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
-     <!-- Catalina Cluster/HA JAR File -->
-     <jarIt jarfile="${catalina-ha.jar}"
-       filesDir="${tomcat.classes}"
-       filesId="files.catalina-ha"
--      addOSGi="true" />
-+      addOSGi="false" />
- 
-     <!-- Server-Side Includes (SSI) -->
+
+     <!-- Catalina Cluster/HA JAR File - STUB for JWS-3904 -->
+     <jar destfile="${catalina-ha.jar}">
+@@ -1279,7 +1279,7 @@
      <jarIt jarfile="${catalina-ssi.jar}"
        filesDir="${tomcat.classes}"
        filesId="files.catalina-ssi"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- Catalina Ant Tasks JAR File -->
      <jarIt jarfile="${catalina-ant.jar}"
-@@ -1258,27 +1258,27 @@
+@@ -1290,27 +1290,27 @@
      <jarIt jarfile="${catalina-storeconfig.jar}"
        filesDir="${tomcat.classes}"
        filesId="files.catalina-storeconfig"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- Jasper EL Implementation JAR File -->
      <jarIt jarfile="${jasper-el.jar}"
        filesDir="${tomcat.classes}"
@@ -159,7 +149,7 @@
        meta-inf="${tomcat.manifests}/jasper-el.jar"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- Jasper Implementation JAR File -->
      <jarIt jarfile="${jasper.jar}"
        filesDir="${tomcat.classes}"
@@ -167,17 +157,17 @@
        meta-inf="${tomcat.manifests}/jasper.jar"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- Re-packaged Apache Commons DBCP 2-->
      <jarIt jarfile="${tomcat-dbcp.jar}"
        filesDir="${tomcat.classes}"
        filesId="files.tomcat-dbcp"
 -      addOSGi="true" />
 +      addOSGi="false" />
- 
+
      <!-- i18n JARs -->
      <jar jarfile="${tomcat.build}/lib/tomcat-i18n-cs.jar"
-@@ -1742,7 +1742,7 @@
+@@ -1774,7 +1774,7 @@
             filesId="files.tomcat-embed-core"
             notice="${tomcat.manifests}/servlet-api.jar.notice"
             license="${tomcat.manifests}/servlet-api.jar.license"
@@ -186,7 +176,7 @@
             addGraal="true"
             graalPrefix="org.apache.tomcat.embed/tomcat-embed-core"
             graalFiles="res/graal/tomcat-embed-core/native-image"
-@@ -1750,7 +1750,7 @@
+@@ -1782,7 +1782,7 @@
      <jarIt jarfile="${tomcat-embed-el.jar}"
             filesDir="${tomcat.classes}"
             filesId="files.tomcat-embed-el"
@@ -195,7 +185,7 @@
             addGraal="true"
             graalPrefix="org.apache.tomcat.embed/tomcat-embed-el"
             graalFiles="res/graal/tomcat-embed-el/native-image"
-@@ -1759,7 +1759,7 @@
+@@ -1791,7 +1791,7 @@
             filesDir="${tomcat.classes}"
             filesId="files.tomcat-embed-jasper"
             meta-inf="${tomcat.manifests}/jasper.jar"
@@ -204,7 +194,7 @@
             addGraal="true"
             graalPrefix="org.apache.tomcat.embed/tomcat-embed-jasper"
             graalFiles="res/graal/tomcat-embed-jasper/native-image"
-@@ -1768,7 +1768,7 @@
+@@ -1800,7 +1800,7 @@
             filesDir="${tomcat.classes}"
             filesId="files.tomcat-embed-websocket"
             meta-inf="${tomcat.manifests}/tomcat-websocket.jar"
diff --git a/sources b/sources
index ba9a607..736eeb7 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (tomcat-10.1.49.redhat-00007-src.zip) = f72bf5cb755e14a0c4555bcdc3db6bef64c8353339699fc321d6ec2162c72b6999807ddbf3910d9a3217c20df7e94baf5b2c9bb5da7e143c776d01589a41dc4a
+SHA512 (tomcat-10.1.49.redhat-00011-src.zip) = ddb3f1e9f601d23752d81f9495a645f31cb47f86f741f75d22695ebedd2a1da952c59ec99acf160cb2df122765ab1821cb95b00773c22ccc8662192fcc2d220b
diff --git a/tomcat.spec b/tomcat.spec
index 0016d5e..76b0751 100644
--- a/tomcat.spec
+++ b/tomcat.spec
@@ -32,7 +32,7 @@
 %global major_version 10
 %global minor_version 1
 %global micro_version 49
-%global packdname %{name}-%{major_version}.%{minor_version}.%{micro_version}.redhat-00007-src
+%global packdname %{name}-%{major_version}.%{minor_version}.%{micro_version}.redhat-00011-src
 %global servletspec 6.0
 %global elspec 5.0
 %global tcuid 53
@@ -54,7 +54,7 @@
 Name:          tomcat
 Epoch:         1
 Version:       %{major_version}.%{minor_version}.%{micro_version}
-Release:       1%{?dist}.1.alma.1
+Release:       3%{?dist}.alma.1
 Summary:       Apache Servlet/JSP Engine, RI for Servlet %{servletspec}/JSP %{jspspec} API
 
 License:       Apache-2.0
@@ -85,6 +85,7 @@ Patch7:        build-with-java-25.patch
 BuildArch:     noarch
 
 ExcludeArch: i686
+ExclusiveArch:  %{java_arches} noarch
 
 BuildRequires: ant >= 1.10.2
 BuildRequires: ecj >= 4.20
@@ -220,6 +221,9 @@ find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name "
 %mvn_alias "org.apache.tomcat:tomcat-jsp-api" "jakarta.servlet:jakarta.servlet.jsp"
 %mvn_package ":tomcat-servlet-api" tomcat-servlet-api
 
+%pom_remove_dep org.apache.tomcat:tomcat-tribes res/maven/tomcat-storeconfig.pom
+%pom_remove_dep org.apache.tomcat:tomcat-catalina-ha res/maven/tomcat-storeconfig.pom
+
 
 %build
 # we don't care about the tarballs and we're going to replace jars
@@ -287,6 +291,10 @@ pushd output/build
     %{__cp} -a webapps/* ${RPM_BUILD_ROOT}%{appdir}
 popd
 
+# Clustering is unsupported in RHEL
+rm -f ${RPM_BUILD_ROOT}%{libdir}/catalina-ha.jar
+rm -f ${RPM_BUILD_ROOT}%{libdir}/catalina-tribes.jar
+
 %{__sed} -e "s|\@\@\@TCHOME\@\@\@|%{homedir}|g" \
    -e "s|\@\@\@TCTEMP\@\@\@|%{tempdir}|g" \
    -e "s|\@\@\@LIBDIR\@\@\@|%{_libdir}|g" %{SOURCE1} \
@@ -388,8 +396,6 @@ popd
 %mvn_artifact res/maven/tomcat-api.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-api.jar
 %mvn_file org.apache.tomcat:tomcat-catalina-ant tomcat/catalina-ant
 %mvn_artifact res/maven/tomcat-catalina-ant.pom ${RPM_BUILD_ROOT}%{libdir}/catalina-ant.jar
-%mvn_file org.apache.tomcat:tomcat-catalina-ha tomcat/catalina-ha
-%mvn_artifact res/maven/tomcat-catalina-ha.pom ${RPM_BUILD_ROOT}%{libdir}/catalina-ha.jar
 %mvn_file org.apache.tomcat:tomcat-catalina tomcat/catalina
 %mvn_artifact res/maven/tomcat-catalina.pom ${RPM_BUILD_ROOT}%{libdir}/catalina.jar
 %mvn_artifact res/maven/tomcat-coyote.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-coyote.jar
@@ -417,8 +423,6 @@ popd
 %mvn_artifact res/maven/tomcat-ssi.pom ${RPM_BUILD_ROOT}%{libdir}/catalina-ssi.jar
 %mvn_file org.apache.tomcat:tomcat-storeconfig tomcat/catalina-storeconfig
 %mvn_artifact res/maven/tomcat-storeconfig.pom ${RPM_BUILD_ROOT}%{libdir}/catalina-storeconfig.jar
-%mvn_file org.apache.tomcat:tomcat-tribes tomcat/catalina-tribes
-%mvn_artifact res/maven/tomcat-tribes.pom ${RPM_BUILD_ROOT}%{libdir}/catalina-tribes.jar
 %mvn_artifact res/maven/tomcat-util-scan.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-util-scan.jar
 %mvn_artifact res/maven/tomcat-util.pom ${RPM_BUILD_ROOT}%{libdir}/tomcat-util.jar
 %mvn_file org.apache.tomcat:tomcat-websocket-api tomcat/websocket-api
@@ -553,9 +557,20 @@ exit 0
 %{appdir}/ROOT
 
 %changelog
-* Tue May 19 2026 Eduard Abdullin <eabdullin@almalinux.org> - 1:10.1.49-1.1.alma.1
+* Fri Jul 10 2026 Eduard Abdullin <eabdullin@almalinux.org> - 1:10.1.49-3.alma.1
 - Exclude i686 architecture from build
 
+* Mon Jul 6 2026 Pietro Meloni <pmeloni@redhat.com> - 1:10.1.49-3
+- Related: RHEL-168577 Remove unnecessary patch
+
+* Thu Jun 4 2026 Pietro Meloni <pmeloni@redhat.com> - 1:10.1.49-2
+- Resolves: RHEL-168577 Remove tomcat clustering JAR from RPM builds
+  Resolves: CVE-2026-29146
+  tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor
+  Resolves: CVE-2026-34486
+  tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass
+
+
 * Wed Apr 22 2026 Pietro Meloni <pmeloni@redhat.com> - 1:10.1.36-3.el10_1.1
 - Resolves: RHEL-150719
   Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)
@@ -571,6 +586,9 @@ exit 0
 - Resolves: RHEL-132526
   tomcat: Denial of service (CVE-2025-61795)
 
+* Mon Dec 15 2025 Eduard Abdullin <eabdullin@almalinux.org> - 1:10.1.36-4
+- Exclude i686 architecture from build
+
 * Thu Aug 14 2025 Adam Krajcik <akrajcik@redhat.com> - 1:10.1.36-3
 - Resolves: RHEL-102184
   tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)