Most recent entries from all

BIT-tomcat-2026-66299 — Apache Tomcat: DoS via WebSocket chat example

Affected: Bitnami: tomcat

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.

Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

certfr-2026-avi-0940 — Une vulnérabilité a été découverte dans Apache Tomcat. Elle permet à un attaquant de provoquer un déni de service à dis…

certfr-2026-avi-0940

EUVD-2026-342164

fkie_cve-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.

This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.

Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

GHSA-rpf9-hrjr-88fv

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.

Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

NCSC-2026-0375 — Kwetsbaarheden verholpen in Oracle Communications

NCSC-2026-0375

OESA-2026-3233 — tomcat security update

Affected: openEuler:24.03-LTS-SP1: tomcat, openEuler:24.03-LTS-SP3: tomcat, openEuler:24.03-LTS-SP4: tomcat, openEuler:20.03-LTS-SP4: tomcat, openEuler:22.03-LTS-SP4: tomcat

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fix(es):

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.(CVE-2026-66299)

openSUSE-SU-2026:11759-1 — tomcat-9.0.121-1.1 on GA media

tomcat-9.0.121-1.1 on GA media

RHSA-2026:56039 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

tomcat: Apache Tomcat: Security constraint bypass due to improper access control tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing tomcat: Apache Tomcat: Denial of Service via WebSocket chat example tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination

SUSE-SU-2026:23690-1 — Security update for tomcat10

Security update for tomcat10

UBUNTU-CVE-2026-66299

Affected: Ubuntu:Pro:14.04:LTS: tomcat6, Ubuntu:Pro:14.04:LTS: tomcat7, Ubuntu:Pro:16.04:LTS: tomcat8, Ubuntu:Pro:16.04:LTS: tomcat7, Ubuntu:Pro:18.04:LTS: tomcat8, Ubuntu:Pro:18.04:LTS: tomcat9, Ubuntu:Pro:20.04:LTS: tomcat9, Ubuntu:Pro:22.04:LTS: tomcat9, Ubuntu:24.04:LTS: tomcat10, Ubuntu:24.04:LTS: tomcat9 and 3 more

WID-SEC-W-2026-2571 — Apache Tomcat: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Tomcat ausnutzen, um einen Denial of Service Angriff durchzuführen.