Most recent entries from all

ALSA-2026:19054 — Important: tomcat security update

Affected: AlmaLinux:10: tomcat, AlmaLinux:10: tomcat-admin-webapps, AlmaLinux:10: tomcat-docs-webapp, AlmaLinux:10: tomcat-el-5.0-api, AlmaLinux:10: tomcat-jsp-3.1-api, AlmaLinux:10: tomcat-lib, AlmaLinux:10: tomcat-servlet-6.0-api, AlmaLinux:10: tomcat-webapps

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-05104

BIT-tomcat-2026-24734 — Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

Affected: Bitnami: tomcat

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0 through 11.0.17, from 10.1.0 through 10.1.51, from 9.0.83 through 9.0.114.

The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.

certfr-2026-avi-0181 — Une vulnérabilité a été découverte dans Apache Tomcat. Elle permet à un attaquant de provoquer un contournement de la p…

certfr-2026-avi-0181

CLEANSTART-2026-ZP28661 — Security fix for CVE-2026-24734 applied in: thingsboard 4.3.0.1-r2

Affected: CleanStart: thingsboard

Security vulnerability affects the thingsboard package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-337932

fkie_cve-2026-24734

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.

The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.

GHSA-mgp5-rv84-w37q — Apache Tomcat has an Improper Input Validation vulnerability

Affected: Maven: org.apache.tomcat:tomcat-coyote, Maven: org.apache.tomcat.embed:tomcat-embed-core

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.

NCSC-2026-0325 — Kwetsbaarheden verholpen in Atlassian producten

NCSC-2026-0325

OESA-2026-1651 — tomcat security update

Affected: openEuler:24.03-LTS: tomcat, openEuler:24.03-LTS-SP1: tomcat, openEuler:24.03-LTS-SP2: tomcat, openEuler:24.03-LTS-SP3: tomcat, openEuler:20.03-LTS-SP4: tomcat, openEuler:22.03-LTS-SP4: tomcat

Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.(CVE-2025-66614)

Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not…

openSUSE-SU-2026:10305-1 — tomcat-9.0.115-1.1 on GA media

tomcat-9.0.115-1.1 on GA media

RHSA-2026:5611 — Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.1 release and security update

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation

RLSA-2026:25341 — Important: tomcat9 security update

Affected: Rocky Linux:10: tomcat9

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)

* tomcat: Client certificate verification bypass due to virtual host mapping (CVE-2025-66614)

* tomcat: security constraint bypass with HTTP/0.9 (CVE-2026-24733)

* Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration (CVE-2026-29145)

* Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files (CVE-2026-34487)

* Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve (CVE-2026-25854)

* Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension (CVE-2026-24880)

* Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration (CVE-2026-34500)

* Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve (CVE-2026-34483)

For more details about the security issue(s), including the…

SUSE-SU-2026:20926-1 — Security update for tomcat11

Security update for tomcat11

UBUNTU-CVE-2026-24734

Affected: Ubuntu:24.04:LTS: tomcat10, Ubuntu:25.10: tomcat10, Ubuntu:25.10: tomcat11, Ubuntu:25.10: tomcat9, Ubuntu:26.04:LTS: tomcat10

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.

WID-SEC-W-2026-0443 — Apache Tomcat und Tomcat Native: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Tomcat und Tomcat Native ausnutzen, um Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.