Most recent entries from all

certfr-2026-avi-1218 — De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Certaines d'entre elles permettent à un attaquant d…

certfr-2026-avi-1218

fkie_cve-2026-78383

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

GHSA-rpxf-vjhq-9cv9

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

openSUSE-SU-2026:11906-1 — tomcat-9.0.122-1.1 on GA media

tomcat-9.0.122-1.1 on GA media

RHSA-2026:68257 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists tomcat: Apache Tomcat: Cross-context authentication mix-up via Jakarta Authentication misconfiguration tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints tomcat: Apache Tomcat: Request smuggling vulnerability can lead to denial of service tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close tomcat: Apache Tomcat: Denial of Service via AJP request tomcat: Apache Tomcat: Denial of Service via malformed HTTP/2 request tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts tomcat: Apache Tomcat: HTTP/2 request smuggling due to header mix-up tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling

UBUNTU-CVE-2026-78383

Affected: Ubuntu:Pro:14.04:LTS: tomcat6, Ubuntu:Pro:14.04:LTS: tomcat7, Ubuntu:Pro:16.04:LTS: tomcat8, Ubuntu:Pro:16.04:LTS: tomcat7, Ubuntu:Pro:18.04:LTS: tomcat8, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:Pro:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:24.04:LTS: tomcat10, Ubuntu:24.04:LTS: tomcat9 and 3 more

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.