Apache Tomcat 11.0.0.M1 < 11.0.26 multiple vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(349471);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/25");

  script_cve_id(
    "CVE-2026-73581",
    "CVE-2026-75973",
    "CVE-2026-76183",
    "CVE-2026-77756",
    "CVE-2026-77762",
    "CVE-2026-77791",
    "CVE-2026-78383",
    "CVE-2026-78437",
    "CVE-2026-79677",
    "CVE-2026-86248",
    "CVE-2026-86350",
    "CVE-2026-87022"
  );
  script_xref(name:"IAVA", value:"2026-A-1039");

  script_name(english:"Apache Tomcat 11.0.0.M1 < 11.0.26 multiple vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache Tomcat server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Tomcat installed on the remote host is prior to 11.0.26. It is, therefore, affected by multiple
vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.26_security-11 advisory.

  - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled
    vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from
    10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26,
    10.1.60 or 9.0.122, which fix the issue. (CVE-2026-86248)

  - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an
    unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue
    affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1
    through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be
    affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be
    affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

  - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM
    TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from
    11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following
    versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through
    8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version
    11.0.26, 10.1.59, 9.0.122, which fixes the issue. (CVE-2026-73581)

  - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with
    SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the
    realm for the first web application to authenticate a request would be used for all web applications. This
    issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4
    through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be
    affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are
    recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue. (CVE-2026-75973)

  - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints
    for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through
    11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at
    the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through
    7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version
    11.0.26, 10.1.60 or 9.0.122, which fix the issue. (CVE-2026-76183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/apache/tomcat/commit/4fef25fe2ab7509e697af093280b9daadb515615
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?23fd0d1e");
  # https://github.com/apache/tomcat/commit/192bc74996e1ad35d79118f750574d366bd43cea
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a3edb37d");
  # https://github.com/apache/tomcat/commit/9aab76056e7470bcc8ca9a20b33b6558b1046da2
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8e37f8d1");
  # https://github.com/apache/tomcat/commit/7ab11d10de79a7a2226f41c8289871db69c6ca9c
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0704cc06");
  # https://github.com/apache/tomcat/commit/70579060454a203977b5696ece71e7cbd6ee9bde
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cbd61dfc");
  # https://github.com/apache/tomcat/commit/6dabd4303095785183ede57f6d162c542955a5a8
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?17c4bd6c");
  # https://github.com/apache/tomcat/commit/ce291bbc65393e3bfbec2a8d23fcee0106a1ade9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?394892d5");
  # https://github.com/apache/tomcat/commit/fd309997dfd0d351b26959a8afd7bffec33dd0de
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f27ff6f9");
  # https://github.com/apache/tomcat/commit/1ad63de866a6e7007304ebe5165f72e65ece32b6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?98bd1d3b");
  # https://github.com/apache/tomcat/commit/e182d86b7d4cc19ec4c24c38f37acc004404fe8e
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?70ed48e8");
  # https://github.com/apache/tomcat/commit/2585fc798f24f0b8811fd20ad9b4e8affb6f69a6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?159f5c57");
  # https://github.com/apache/tomcat/commit/15a76156ced9f6a6306ef7d6f2e343034231a2de
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bdf3b0a1");
  # https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.26
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cabbbb0f");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Tomcat version 11.0.26 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-78383");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-86248");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/23");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:tomcat:11");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin");
  script_require_keys("installed_sw/Apache Tomcat");

  exit(0);
}

include('vcf_extras.inc');

vcf::tomcat::initialize();
var app_info = vcf::combined_get_app_info(app:'Apache Tomcat');

var constraints = [
  { 'min_version' : '11.0.0.M1', 'max_version' : '11.0.25', 'fixed_version' : '11.0.26' }
];

vcf::check_all_backporting(app_info:app_info);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);