{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-65182: ensure the security constraint with the longest matching path\n is selected (upstream tomcat 9.0.121)\n- CVE-2026-65183: improve the security of Unix domain sockets in the NIO and APR\n connectors (upstream tomcat 9.0.121 and 9.0.123)\n- CVE-2026-65905: fix incorrect rejection at the upper boundary of the DIGEST\n nonceCount window (upstream tomcat 9.0.121)\n- CVE-2026-65927: correct the rule index reset for [N], chain rule and query\n string processing in the rewrite valve (upstream tomcat 9.0.121)\n- CVE-2026-66422: separate the Context role mapping from security-role-ref\n (upstream tomcat 9.0.121)\n- CVE-2026-68525: refresh the security constraints after FORM authentication\n when the restored request changes the HTTP method, so a constraint that limits\n POST but not GET is re-evaluated instead of being bypassed (upstream tomcat\n 9.0.121)\n- CVE-2026-68569: various improvements to the DataSourceRealm and JDBCRealm\n (upstream tomcat 9.0.121, plus 45a3c1ef from the 9.0.x branch for a\n DataSourceRealm without a role store); a JDBCRealm in the default strict\n allRolesMode now needs a role store\n- CVE-2026-68763: return the unused HTTP/2 connection window allocation and drop\n the stream from the backlog when a stream is replaced after a reset, and keep\n backLogSize consistent, preventing a flow control allocation leak (upstream\n tomcat 9.0.121)\n- CVE-2026-73180: track the WebSocket sessions of an authenticated HTTP session\n by a key held in a session attribute rather than the live session id, so they\n are still closed when the HTTP session ends after its id has changed (upstream\n tomcat 9.0.121)", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.8esu/advisories/2026/clsa-2026_1791830321.json" } ], "tracking": { "current_release_date": "2026-10-12T18:40:12Z", "generator": { "date": "2026-10-12T18:40:12Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1791830321", "initial_release_date": "2026-10-12T18:40:12Z", "revision_history": [ { "date": "2026-10-12T18:40:12Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "tomcat: Fix of 9 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AlmaLinux 9.8", "product": { "name": "AlmaLinux 9.8", "product_id": "AlmaLinux-9.8", "product_identification_helper": { "cpe": "cpe:2.3:o:almalinux:almalinux:9.8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "AlmaLinux" } ], "category": "vendor", "name": "AlmaLinux OS Foundation" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Rocky Linux 9.8", "product": { "name": "Rocky Linux 9.8", "product_id": "Rocky Linux-9.8", "product_identification_helper": { "cpe": "cpe:2.3:o:resf:rocky_linux:9.8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Rocky Linux" } ], "category": "vendor", "name": "Rocky Linux" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product": { "name": "tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_id": "tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/tomcat-el-3.0-api@9.0.120-2.el9_8.tuxcare.els1?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product": { "name": "tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_id": "tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/tomcat-servlet-4.0-api@9.0.120-2.el9_8.tuxcare.els1?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product": { "name": "tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_id": "tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/tomcat-lib@9.0.120-2.el9_8.tuxcare.els1?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product": { "name": "tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_id": "tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/tomcat-docs-webapp@9.0.120-2.el9_8.tuxcare.els1?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product": { "name": "tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_id": "tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/tomcat-admin-webapps@9.0.120-2.el9_8.tuxcare.els1?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product": { "name": "tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_id": "tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/tomcat-jsp-2.3-api@9.0.120-2.el9_8.tuxcare.els1?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product": { "name": "tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_id": "tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/tomcat-webapps@9.0.120-2.el9_8.tuxcare.els1?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product": { "name": "tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_id": "tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/tomcat@9.0.120-2.el9_8.tuxcare.els1?arch=noarch&epoch=1" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch" }, "product_reference": "tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "relates_to_product_reference": "Rocky Linux-9.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-73180", "cwe": { "id": "CWE-613", "name": "Insufficient Session Expiration" }, "notes": [ { "category": "description", "text": "Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-73180" }, { "category": "external", "summary": "https://lists.apache.org/thread/3j15vztszpyqss253mjq5v1kp7s6hooq", "url": "https://lists.apache.org/thread/3j15vztszpyqss253mjq5v1kp7s6hooq" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/08/26/10", "url": "http://www.openwall.com/lists/oss-security/2026/08/26/10" } ], "release_date": "2026-08-25T22:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-12T18:38:43.044644Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321", "product_ids": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-65182", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "description", "text": "Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-65182" }, { "category": "external", "summary": "https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m", "url": "https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/08/26/1", "url": "http://www.openwall.com/lists/oss-security/2026/08/26/1" } ], "release_date": "2026-08-25T22:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-12T18:38:43.044644Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321", "product_ids": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-68569", "cwe": { "id": "CWE-287", "name": "Improper Authentication" }, "notes": [ { "category": "description", "text": "Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68569" }, { "category": "external", "summary": "https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc", "url": "https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/08/26/8", "url": "http://www.openwall.com/lists/oss-security/2026/08/26/8" } ], "release_date": "2026-08-25T22:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-12T18:38:43.044644Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321", "product_ids": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-65927", "cwe": { "id": "CWE-193", "name": "Off-by-one Error" }, "notes": [ { "category": "description", "text": "Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-65927" }, { "category": "external", "summary": "https://lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4", "url": "https://lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/08/26/5", "url": "http://www.openwall.com/lists/oss-security/2026/08/26/5" } ], "release_date": "2026-08-25T22:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-12T18:38:43.044644Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321", "product_ids": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-68763", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68763" }, { "category": "external", "summary": "https://lists.apache.org/thread/tv51ty39ppv41v04hdtkp9dp7tg02nzl", "url": "https://lists.apache.org/thread/tv51ty39ppv41v04hdtkp9dp7tg02nzl" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/08/26/9", "url": "http://www.openwall.com/lists/oss-security/2026/08/26/9" } ], "release_date": "2026-08-25T22:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-12T18:38:43.044644Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321", "product_ids": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-65905", "cwe": { "id": "CWE-294", "name": "Authentication Bypass by Capture-replay" }, "notes": [ { "category": "description", "text": "Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST \nauthenticated request with a nonceCount on the upper boundary of the \nreplay window then that request is replayable once only while the \nassociated nonceCount remains within the replay window.\n\n\n\n \n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-65905" }, { "category": "external", "summary": "https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj", "url": "https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/08/26/4", "url": "http://www.openwall.com/lists/oss-security/2026/08/26/4" } ], "release_date": "2026-08-25T22:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-12T18:38:43.044644Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321", "product_ids": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-65183", "cwe": { "id": "CWE-367", "name": "Time-of-check Time-of-use (TOCTOU) Race Condition" }, "notes": [ { "category": "description", "text": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-65183" }, { "category": "external", "summary": "https://lists.apache.org/thread/748o4st6d5dk6n3l7tgzo5yl68gg05c0", "url": "https://lists.apache.org/thread/748o4st6d5dk6n3l7tgzo5yl68gg05c0" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/08/26/2", "url": "http://www.openwall.com/lists/oss-security/2026/08/26/2" } ], "release_date": "2026-08-25T22:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-12T18:38:43.044644Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321", "product_ids": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-66422", "cwe": { "id": "CWE-285", "name": "Improper Authorization" }, "notes": [ { "category": "description", "text": "Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-66422" }, { "category": "external", "summary": "https://lists.apache.org/thread/j5plylz1b2vhqvbkqn7k58nygxhcpk73", "url": "https://lists.apache.org/thread/j5plylz1b2vhqvbkqn7k58nygxhcpk73" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/08/26/6", "url": "http://www.openwall.com/lists/oss-security/2026/08/26/6" } ], "release_date": "2026-08-25T22:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-12T18:38:43.044644Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321", "product_ids": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-68525", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "description", "text": "Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68525" }, { "category": "external", "summary": "https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7", "url": "https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/08/26/7", "url": "http://www.openwall.com/lists/oss-security/2026/08/26/7" } ], "release_date": "2026-08-25T22:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-12T18:38:43.044644Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321", "product_ids": [ "AlmaLinux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "AlmaLinux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-admin-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-docs-webapp-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-el-3.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-jsp-2.3-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-lib-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-servlet-4.0-api-1:9.0.120-2.el9_8.tuxcare.els1.noarch", "Rocky Linux-9.8:tomcat-webapps-1:9.0.120-2.el9_8.tuxcare.els1.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791830321" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }