https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:30:00 +0000 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1218 certfr-2026-avi-1218 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1218 https://vulnerability.circl.lu/vuln/fkie_cve-2026-75973 <p>Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications.</p> <p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121.</p> <p>The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.</p> <p>Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.</p> <p>Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications.</p> <p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121.</p> <p>The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.</p> <p>Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-75973 https://vulnerability.circl.lu/vuln/ghsa-q9fp-9gfr-vj9g <p>Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications.</p> <p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121.</p> <p>The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.</p> <p>Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.</p> <p>Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications.</p> <p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121.</p> <p>The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.</p> <p>Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/ghsa-q9fp-9gfr-vj9g https://vulnerability.circl.lu/vuln/opensuse-su-2026:11906-1 <p>tomcat-9.0.122-1.1 on GA media</p> <p>tomcat-9.0.122-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11906-1 https://vulnerability.circl.lu/vuln/rhsa-2026:68257 <p>tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists tomcat: Apache Tomcat: Cross-context authentication mix-up via Jakarta Authentication misconfiguration tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints tomcat: Apache Tomcat: Request smuggling vulnerability can lead to denial of service tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close tomcat: Apache Tomcat: Denial of Service via AJP request tomcat: Apache Tomcat: Denial of Service via malformed HTTP/2 request tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling</p> <p>tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists tomcat: Apache Tomcat: Cross-context authentication mix-up via Jakarta Authentication misconfiguration tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints tomcat: Apache Tomcat: Request smuggling vulnerability can lead to denial of service tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close tomcat: Apache Tomcat: Denial of Service via AJP request tomcat: Apache Tomcat: Denial of Service via malformed HTTP/2 request tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling</p> https://vulnerability.circl.lu/vuln/rhsa-2026:68257 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-75973 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: tomcat6, Ubuntu:Pro:14.04:LTS: tomcat7, Ubuntu:Pro:16.04:LTS: tomcat8, Ubuntu:Pro:16.04:LTS: tomcat7, Ubuntu:Pro:18.04:LTS: tomcat8, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:Pro:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:24.04:LTS: tomcat10, Ubuntu:24.04:LTS: tomcat9 and 3 more</p> <p>Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: tomcat6, Ubuntu:Pro:14.04:LTS: tomcat7, Ubuntu:Pro:16.04:LTS: tomcat8, Ubuntu:Pro:16.04:LTS: tomcat7, Ubuntu:Pro:18.04:LTS: tomcat8, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:Pro:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:24.04:LTS: tomcat10, Ubuntu:24.04:LTS: tomcat9 and 3 more</p> <p>Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-75973