Most recent entries from all

bdu:2026-05102

BIT-tomcat-2026-24733 — Apache Tomcat: Security constraint bypass with HTTP/0.9

Affected: Bitnami: tomcat

Improper Input Validation vulnerability in Apache Tomcat.

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.14, from 10.1.0 through 10.1.49, from 9.0.0 through 9.0.112.

Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.

certfr-2026-avi-0199 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq…

certfr-2026-avi-0199

Withdrawn: CLEANSTART-2026-IS05941 — CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apa…

Withdrawn by the publisher.

Affected: CleanStart: thingsboard

Multiple security vulnerabilities affect the thingsboard package. CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. See references for individual vulnerability details.

EUVD-2026-275508

fkie_cve-2026-24733

Improper Input Validation vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.

Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.

GHSA-qq5r-98hh-rxc9 — Apache Tomcat - Security constraint bypass with HTTP/0.9

Affected: Maven: org.apache.tomcat:tomcat-coyote

Improper Input Validation vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.

Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.

OESA-2026-1651 — tomcat security update

Affected: openEuler:24.03-LTS: tomcat, openEuler:24.03-LTS-SP1: tomcat, openEuler:24.03-LTS-SP2: tomcat, openEuler:24.03-LTS-SP3: tomcat, openEuler:20.03-LTS-SP4: tomcat, openEuler:22.03-LTS-SP4: tomcat

Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.(CVE-2025-66614)

Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not…

openSUSE-SU-2026:10305-1 — tomcat-9.0.115-1.1 on GA media

tomcat-9.0.115-1.1 on GA media

RHSA-2026:12194 — Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.2 release and security update

tomcat: Client certificate verification bypass due to virtual host mapping tomcat: security constraint bypass with HTTP/0.9 Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix

RLSA-2026:25341 — Important: tomcat9 security update

Affected: Rocky Linux:10: tomcat9

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)

* tomcat: Client certificate verification bypass due to virtual host mapping (CVE-2025-66614)

* tomcat: security constraint bypass with HTTP/0.9 (CVE-2026-24733)

* Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration (CVE-2026-29145)

* Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files (CVE-2026-34487)

* Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve (CVE-2026-25854)

* Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension (CVE-2026-24880)

* Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration (CVE-2026-34500)

* Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve (CVE-2026-34483)

For more details about the security issue(s), including the…

SUSE-SU-2026:0922-1 — Security update for tomcat

Security update for tomcat

UBUNTU-CVE-2026-24733

Affected: Ubuntu:Pro:14.04:LTS: tomcat6, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:Pro:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:24.04:LTS: tomcat10, Ubuntu:24.04:LTS: tomcat9, Ubuntu:25.10: tomcat10, Ubuntu:25.10: tomcat11, Ubuntu:25.10: tomcat9, Ubuntu:26.04:LTS: tomcat10

Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112. Older, EOL versions are also affected. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.

WID-SEC-W-2026-0443 — Apache Tomcat und Tomcat Native: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Tomcat und Tomcat Native ausnutzen, um Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.