Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-25854, CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990)

Summary IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core CVE-2026-25854, CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990 Vulnerability Details CVEID:CVE-2026-25854 DESCRIPTION: Occasional URL redirection to untrusted Site 'Open Redirect' vulnerability i...

ROOT-APP-MAVEN-CVE-2026-29145 CVE-2026-29145 in io.root.org.apache.tomcat:tomcat-catalina - Patched by Root

Root has patched CVE-2026-29145 in the io.root.org.apache.tomcat:tomcat-catalina package for Root:Maven. Multiple fixed versions available...

Exploit for Improper Authentication in Apache Tomcat

CVE-2026-29145 – Everything Apache Tomcat CLIENTCERT + OCS...

Atlassian Confluence 9.1.0 < 9.2.20 / 9.3.1 < 10.2.11 (CONFSERVER-103709)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-103709 advisory. - This BASM Broken Authentication & Session Management vulnerability allows an unauthenticated attacker to perform actions as another user which ha...

CVE-2026-29145 vulnerabilities

Vulnerabilities for packages: thingsboard...

Amazon Linux 2023 : tomcat-native (ALAS2023-2026-1595)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1595 advisory. CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1...

Security update for tomcat

This update for tomcat fixes the following issues: Security fixes: CVE-2026-24880: Request smuggling via invalid chunk extension bsc1261850. CVE-2026-25854: Occasionally open redirect bsc1261851. CVE-2026-29129: TLS cipher order is not preserved bsc1261852. CVE-2026-29145: OCSP checks sometimes...

Security update for tomcat10

This update for tomcat10 fixes the following issues: Security fixes: CVE-2026-24880: Request smuggling via invalid chunk extension bsc1261850. CVE-2026-25854: Occasionally open redirect bsc1261851. CVE-2026-29129: TLS cipher order is not preserved bsc1261852. CVE-2026-29145: OCSP checks sometimes...

Security update for tomcat

This update for tomcat fixes the following issues: Security fixes: CVE-2026-24880: Request smuggling via invalid chunk extension bsc1261850. CVE-2026-25854: Occasionally open redirect bsc1261851. CVE-2026-29129: TLS cipher order is not preserved bsc1261852. CVE-2026-29145: OCSP checks sometimes...

SUSE-SU-2026:1572-1 Security update for tomcat

This update for tomcat fixes the following issues: Security fixes: - CVE-2026-24880: Request smuggling via invalid chunk extension bsc1261850. - CVE-2026-25854: Occasionally open redirect bsc1261851. - CVE-2026-29129: TLS cipher order is not preserved bsc1261852. - CVE-2026-29145: OCSP checks...

Security update for tomcat10 (important)

openSUSE security update: security update for tomcat10 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20612-1 Rating: important References: bsc1258371 bsc1261850 bsc1261851 bsc1261852 bsc1261853 bsc1261854 bsc1261855 bsc1261856 bsc1261857...

OPENSUSE-SU-2026:20595-1 Security update for tomcat11

This update for tomcat11 fixes the following issues: - Update to Tomcat 11.0.21 - CVE-2026-24880: Request smuggling via invalid chunk extension bsc1261850. - CVE-2026-25854: Occasionally open redirect bsc1261851. - CVE-2026-29129: TLS cipher order is not preserved bsc1261852. - CVE-2026-29145: OC...

tomcat-9.0.117-1.1 on GA media (moderate)

tomcat-9.0.117-1.1 on GA media Announcement ID: openSUSE-SU-2026:10547-1 Rating: moderate Cross-References: CVE-2026-24880 CVE-2026-25854 CVE-2026-29129 CVE-2026-29145 CVE-2026-29146 CVE-2026-32990 CVE-2026-34483 CVE-2026-34486 CVE-2026-34487 CVE-2026-34500 CVSS scores: CVE-2026-24880 SUSE : 4.8...

tomcat11-11.0.21-1.1 on GA media (moderate)

tomcat11-11.0.21-1.1 on GA media Announcement ID: openSUSE-SU-2026:10549-1 Rating: moderate Cross-References: CVE-2026-24880 CVE-2026-25854 CVE-2026-29129 CVE-2026-29145 CVE-2026-29146 CVE-2026-32990 CVE-2026-34483 CVE-2026-34486 CVE-2026-34487 CVE-2026-34500 CVSS scores: CVE-2026-24880 SUSE : 4....

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.83, <=9.0.115), org.openl.rules.demo:openl-demo-app (>=5.25.16, <=5.25.17) +1 more potentially affected by CVE-2026-29145 via org.apache.tomcat:tomcat (>=9.0.83, <=9.0.115)

org.apache.tomcat:tomcat MAVEN version =9.0.83, =9.0.83, =5.25.16, =8.0.25, =10.0.1 Source cves: CVE-2026-29145 Source advisory: OSV:GHSA-95JQ-RWVF-VJX4...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.83, <=9.0.115), org.openl.rules.demo:openl-demo-app (>=5.25.16, <=5.25.17) +1 more potentially affected by CVE-2026-29145 via org.apache.tomcat:tomcat (>=9.0.83, <=9.0.115)

org.apache.tomcat:tomcat MAVEN version =9.0.83, =9.0.83, =5.25.16, =8.0.25, =10.0.1 Source cves: CVE-2026-29145 Source advisory: GHSA-95JQ-RWVF-VJX4...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-29145 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.52)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.1.4 Source cves: CVE-2026-29145 Source advisory: OSV:GHSA-95JQ-RWVF-VJX4...

CVE-2026-29145

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat...

CVE-2026-29145

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat...

CVE-2026-29145

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat...