Most recent entries from all

BIT-tomcat-2026-68569 — Apache Tomcat: Principal lookup can fail open in some cases

Affected: Bitnami: tomcat

This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.0 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

certfr-2026-avi-1083 — De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Elles permettent à un attaquant de provoquer un dén…

certfr-2026-avi-1083

fkie_cve-2026-68569

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

GHSA-5q6q-ffrq-6xfc

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

OESA-2026-3592 — tomcat security update

Affected: openEuler:24.03-LTS-SP4: tomcat, openEuler:20.03-LTS-SP4: tomcat, openEuler:22.03-LTS-SP4: tomcat, openEuler:24.03-LTS-SP1: tomcat, openEuler:24.03-LTS-SP3: tomcat

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fix(es):

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.(CVE-2026-65182)

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.(CVE-2026-65183)

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.(CVE-2026-65637)

A vulnerability classified as critical has been found in Apache Tomcat up to 7.0.109/8.5.100/9.0.120/10.1.57/11.0.24 (Application Server Software). Affected is an unknown part of the component DIGEST Authenticator. Upgrading to version 9.0.121, 10.1.58 or 11.0.25 eliminates this vulnerability.(CVE-2026-65905)

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the sec…

openSUSE-SU-2026:11759-1 — tomcat-9.0.121-1.1 on GA media

tomcat-9.0.121-1.1 on GA media

RHSA-2026:68257 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists tomcat: Apache Tomcat: Cross-context authentication mix-up via Jakarta Authentication misconfiguration tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints tomcat: Apache Tomcat: Request smuggling vulnerability can lead to denial of service tomcat: Apache Tomcat: Race condition allows HTTP/2 request manipulation tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close tomcat: Apache Tomcat: Denial of Service via AJP request tomcat: Apache Tomcat: Denial of Service via malformed HTTP/2 request tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling

SUSE-SU-2026:23690-1 — Security update for tomcat10

Security update for tomcat10

UBUNTU-CVE-2026-68569

Affected: Ubuntu:Pro:14.04:LTS: tomcat6, Ubuntu:Pro:14.04:LTS: tomcat7, Ubuntu:Pro:16.04:LTS: tomcat8, Ubuntu:Pro:16.04:LTS: tomcat7, Ubuntu:Pro:18.04:LTS: tomcat8, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:Pro:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:24.04:LTS: tomcat10, Ubuntu:24.04:LTS: tomcat9 and 3 more

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.