Most recent entries from all

ALSA-2026:68651 — Moderate: tomcat9 security update

Affected: AlmaLinux:10: tomcat9, AlmaLinux:10: tomcat9-admin-webapps, AlmaLinux:10: tomcat9-docs-webapp, AlmaLinux:10: tomcat9-el-3.0-api, AlmaLinux:10: tomcat9-jsp-2.3-api, AlmaLinux:10: tomcat9-lib, AlmaLinux:10: tomcat9-servlet-4.0-api, AlmaLinux:10: tomcat9-webapps

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512) * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293) * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498) * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515) * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other relate…

bdu:2026-11888

BIT-tomcat-2026-59083 — Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

Affected: Bitnami: tomcat

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.23, from 10.1.0 through 10.1.56, from 9.0.0 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

certfr-2026-avi-0876 — De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Elles permettent à un attaquant de provoquer un con…

certfr-2026-avi-0876

EUVD-2026-336257

fkie_cve-2026-59083

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

GHSA-hcjr-322h-429r

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

OESA-2026-3142 — tomcat security update

Affected: openEuler:22.03-LTS-SP4: tomcat, openEuler:24.03-LTS-SP1: tomcat, openEuler:24.03-LTS-SP3: tomcat, openEuler:24.03-LTS-SP4: tomcat, openEuler:20.03-LTS-SP4: tomcat

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.(CVE-2026-59083)

['Severity: low\n\nAffected versions:\n\n- Apache Tomcat 11.0.0-M1 through 11.0.23\n- Apache Tomcat 10.1.0-M1 through 10.1.56\n- Apache Tomcat 9.0.13 through 9.0.119\n- Apache Tomcat 8.5.38 through 8.5.100\n- Apache Tomcat 7.0.100 through 7.0.109\n\nDescription:', 'Credit:\n\nNDIx (reporter)\n\nReferences:'](CVE-2026-59084)

openSUSE-SU-2026:11399-1 — tomcat-9.0.120-1.1 on GA media

tomcat-9.0.120-1.1 on GA media

RHSA-2026:36872 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

RLSA-2026:68651 — Moderate: tomcat9 security update

Affected: Rocky Linux:10: tomcat9

Security Fix(es):

* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)

* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)

* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)

* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)

* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)

* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)

* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)

* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information…

SUSE-SU-2026:3440-1 — Security update for tomcat

Security update for tomcat

UBUNTU-CVE-2026-59083

Affected: Ubuntu:Pro:14.04:LTS: tomcat6, Ubuntu:Pro:14.04:LTS: tomcat7, Ubuntu:Pro:16.04:LTS: tomcat8, Ubuntu:Pro:16.04:LTS: tomcat7, Ubuntu:Pro:18.04:LTS: tomcat8, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:Pro:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:24.04:LTS: tomcat10, Ubuntu:24.04:LTS: tomcat9 and 3 more

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

WID-SEC-W-2026-2310 — Apache Tomcat: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.