Most recent entries from all

ALSA-2026:36788 — Important: tomcat security, bug fix, and enhancement update

2026-10-02T15:30:05.651306+00:00

Affected: AlmaLinux:10: tomcat, AlmaLinux:10: tomcat-admin-webapps, AlmaLinux:10: tomcat-docs-webapp, AlmaLinux:10: tomcat-el-5.0-api, AlmaLinux:10: tomcat-jsp-3.1-api, AlmaLinux:10: tomcat-lib, AlmaLinux:10: tomcat-servlet-6.0-api, AlmaLinux:10: tomcat-webapps

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

* Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-168577)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-05543

2026-10-02T15:30:05.651415+00:00

bdu:2026-05543

BIT-tomcat-2026-29146 — Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

2026-10-02T15:30:05.651434+00:00

Affected: Bitnami: tomcat

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.18, from 10.0.0 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

certfr-2026-avi-0418 — De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Elles permettent à un attaquant de provoquer une at…

2026-10-02T15:30:05.651461+00:00

certfr-2026-avi-0418

EUVD-2026-354281

2026-10-02T15:30:05.651478+00:00

EUVD-2026-354281

fkie_cve-2026-29146

2026-10-02T15:30:05.651490+00:00

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

GHSA-h468-7pvh-8vr8 — Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

2026-10-02T15:30:05.651516+00:00

Affected: Maven: org.apache.tomcat:tomcat-tribes, Maven: org.apache.tomcat:tomcat

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

OESA-2026-1970 — tomcat security update

2026-10-02T15:30:05.651547+00:00

Affected: openEuler:24.03-LTS-SP3: tomcat, openEuler:20.03-LTS-SP4: tomcat, openEuler:22.03-LTS-SP4: tomcat, openEuler:24.03-LTS: tomcat, openEuler:24.03-LTS-SP1: tomcat, openEuler:24.03-LTS-SP2: tomcat

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fix(es):

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.(CVE-2026-24880)

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-25854)

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53…

openSUSE-SU-2026:10547-1 — tomcat-9.0.117-1.1 on GA media

2026-10-02T15:30:05.651605+00:00

tomcat-9.0.117-1.1 on GA media

RHSA-2026:20405 — Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.3 release and security update

2026-10-02T15:30:05.651632+00:00

Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration

RLSA-2026:36788 — Important: tomcat security, bug fix, and enhancement update

2026-10-02T15:30:05.651685+00:00

Affected: Rocky Linux:10: tomcat

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)

* Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

* Remove tomcat clustering JAR from RPM builds (JIRA:Rocky Linux-168577)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:1572-1 — Security update for tomcat

2026-10-02T15:30:05.651746+00:00

Security update for tomcat

UBUNTU-CVE-2026-29146

2026-10-02T15:30:05.651769+00:00

Affected: Ubuntu:Pro:18.04:LTS: tomcat8, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:Pro:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:24.04:LTS: tomcat10, Ubuntu:24.04:LTS: tomcat9, Ubuntu:25.10: tomcat10, Ubuntu:25.10: tomcat11, Ubuntu:25.10: tomcat9, Ubuntu:26.04:LTS: tomcat10 and 2 more

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

WID-SEC-W-2026-1038 — Apache Tomcat und Tomcat Native: Mehrere Schwachstellen

2026-10-02T15:30:05.651809+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, Open-Redirect-Angriffe durchzuführen und andere, nicht näher spezifizierte Angriffe auszuführen.