PT-2026-97285

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.25 Apache Tomcat versions 10.1.0-M1 through 10.1.59 Apache Tomcat versions 9.0.39 through 9.0.121 Apache Tomcat versions 8.5.59 through 8.5.100 Description A race condition occurs due to improper...

Fixed in Apache Tomcat 10.1.60

Low: WebSocket message smuggling with per-message-deflate CVE-2026-87022 Improper handling of length parameter allows WebSocket message smuggling when per-message-deflate is used. This was fixed with commit 567a8551. This issue was reported to the Tomcat security team on 7 September 2026. The iss...

SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2026:4126-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4126-1 advisory. - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: Apache Tomcat: TOCTOU when...

Fixed in Apache Tomcat 9.0.122

Low: WebSocket message smuggling with per-message-deflate CVE-2026-87022 Improper handling of length parameter allows WebSocket message smuggling when per-message-deflate is used. This was fixed with commit 959a52a2. This issue was reported to the Tomcat security team on 7 September 2026. The iss...

SUSE SLES15: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (SUSE-SU-2026:4119-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4119-1 advisory. - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: Apache Tomcat: TOCTOU when...

SUSE SLES15: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (SUSE-SU-2026:4114-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4114-1 advisory. - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: Apache Tomcat: TOCTOU when...

CVE-2026-69203: Uncontrolled Resource Consumption

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGSMAXCONCURRENTSTREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

OESA-2026-3718 golang security update

. Security Fixes: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client...

OESA-2026-3717 golang security update

. Security Fixes: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client...

OESA-2026-3715 golang security update

. Security Fixes: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client...

Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issues: Security issues fixed: CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272128. CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass ...

SUSE-SU-2026:4178-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issues: Security issues fixed: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272128. - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

Astra Linux – Vulnerability in Tomcat9

A vulnerability exists in Apache Tomcat related to uncontrolled resource consumption, caused by an allocation leak in the HTTP/2 backlog tracking when a stream is reset. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, and from 9.0.39...

Astra Linux – Vulnerability in golang-golang-x-net, golang-1.19

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request’s headers exceed MaxHeaderBytes, no...

Astra Linux – Vulnerability in Golang-Google-GRPC

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have a vulnerability caused by improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path did not start with a leading slash...

Astra Linux – Vulnerability in containerd-app

Due to a missing nil check, sending HTTP/2 frames with values 0x0a-0x0f will cause a running server to panic...

Astra Linux – Vulnerability in Jetty9

In the Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that may result in the active connections and associated resources not being properly cleaned up. This can lead to a Denial of Service scenario, where there are not enough...

Astra Linux – Vulnerability in Netty

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user could trigger a Denial of Service DoS attack on a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server lacks a limit on the number of...