in the camel-spring-boot-bom we have some tomcat overrides, right now, we are not using the Red Hat productized version of tomcat a you can see from camel-spring-boot-bom

We should align the tomcat version to the productized one, for example https://maven.repository.redhat.com/ga/org/apache/tomcat/embed/tomcat-embed-core/ 

As you can see from the former Red Hat Spring Boot support page https://access.redhat.com/articles/7048729 (Traditional Spring Technology : Supported Red Hat Components)