Most recent entries from all

bdu:2026-11862

2026-10-03T09:33:05.845909+00:00

bdu:2026-11862

BIT-tomcat-2026-29129 — Apache Tomcat: TLS cipher order is not preserved

2026-10-03T09:33:05.845964+00:00

Affected: Bitnami: tomcat

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

certfr-2026-avi-0418 — De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Elles permettent à un attaquant de provoquer une at…

2026-10-03T09:33:05.846017+00:00

certfr-2026-avi-0418

EUVD-2026-290467

2026-10-03T09:33:05.846045+00:00

EUVD-2026-290467

fkie_cve-2026-29129

2026-10-03T09:33:05.846063+00:00

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

GHSA-69cc-cv78-qc8g — Apache Tomcat: Configured cipher preference order not preserved

2026-10-03T09:33:05.846097+00:00

Affected: Maven: org.apache.tomcat:tomcat-coyote, Maven: org.apache.tomcat:tomcat, Maven: org.apache.tomcat.embed:tomcat-embed-core

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

OESA-2026-1970 — tomcat security update

2026-10-03T09:33:05.846152+00:00

Affected: openEuler:24.03-LTS-SP3: tomcat, openEuler:20.03-LTS-SP4: tomcat, openEuler:22.03-LTS-SP4: tomcat, openEuler:24.03-LTS: tomcat, openEuler:24.03-LTS-SP1: tomcat, openEuler:24.03-LTS-SP2: tomcat

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.(CVE-2026-24880)

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-25854)

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53…

openSUSE-SU-2026:10547-1 — tomcat-9.0.117-1.1 on GA media

2026-10-03T09:33:05.846244+00:00

tomcat-9.0.117-1.1 on GA media

RLSA-2026:36790 — Important: tomcat9 security, bug fix, and enhancement update

2026-10-03T09:33:05.846277+00:00

Affected: Rocky Linux:10: tomcat9

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)

* Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

* Remove tomcat clustering JAR from RPM builds (JIRA:Rocky Linux-185571)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:1572-1 — Security update for tomcat

2026-10-03T09:33:05.846326+00:00

Security update for tomcat

UBUNTU-CVE-2026-29129

2026-10-03T09:33:05.846361+00:00

Affected: Ubuntu:26.04:LTS: tomcat9, Ubuntu:26.04:LTS: tomcat11

Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

WID-SEC-W-2026-1038 — Apache Tomcat und Tomcat Native: Mehrere Schwachstellen

2026-10-03T09:33:05.846400+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, Open-Redirect-Angriffe durchzuführen und andere, nicht näher spezifizierte Angriffe auszuführen.