Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2026-3166)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3166 advisory. Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects...

Important: tomcat9

Issue Overview: Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from...

Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2026-3165)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3165 advisory. Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2026-029)

The version of tomcat installed on the remote host is prior to 9.0.122-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2026-029 advisory. Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS...

K000163569: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2026-75973 Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to...

BIT-TOMCAT-2026-75973 Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

PT-2026-105205

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

CVE-2026-75973

A flaw was found in Apache Tomcat. When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications utilize it, an improper authentication vulnerability arises. This issue causes the authentication realm established for the first web...

SUSE CVE-2026-75973

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

Linux Distros Unpatched Vulnerability : CVE-2026-75973

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and...

DEBIAN-CVE-2026-75973

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

CVE-2026-75973

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

CVE-2026-75973

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

UBUNTU-CVE-2026-75973

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

Authentication Bypass by Primary Weakness

Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the getServerAuthConfig method in SimpleAuthConfigProvider. When Jakarta Authenticatio...

Authentication Bypass by Primary Weakness

Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the getServerAuthConfig method in SimpleAuthConfigProvider. When Jakarta Authentication uses this provider as the default for multiple web applications, its cached configuration retains the...

Authentication Bypass by Primary Weakness

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the getServerAuthConfig method in SimpleAuthConfigProvider. When Jakarta Authentication uses this provider as the...

CVE-2026-75973

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

EUVD-2026-85224

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

CVE-2026-75973 Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...