SDL Tridion Sites 9.x and SDL Web 8.5 microservices use an embedded version of Tomcat.   You can update the patch version of these embedded Tomcat instances by updating certain JAR files in the lib folder of the microservice.

For SDL Web 8.5/SDL Tridion Sites 9.0, you can update to any patch version of the embedded Tomcat 8.5.x.  So you can go the following location:

https://mvnrepository.com/artifact/org.apache.tomcat.embed

You need to get the patch version of the following libraries:

tomcat-embed-core-8.5.xx.jar
tomcat-embed-websocket-8.5.xx.jar
tomcat-embed-el-8.5.xx.jar
tomcat-annotations-api-8.5.xx.jar

For SDL Tridion Sites 9.1/SDL Tridion Sites 9.5, you can update to any patch version of the embedded Tomcat 9.0.x.  Go to the same link above but get the files for the needed patch version.  These are needed in this case:

tomcat-embed-core-9.0.xx.jar
tomcat-embed-websocket-9.0.xx.jar
tomcat-embed-el-9.0.xx.jar