Rocky Linux 8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_68677)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202668677 advisory. tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43512 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not...

Rocky Linux 10.2 [CIQ] Security Update: tomcat9 / tomcat9-admin-webapps / tomcat9-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_68651)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202668651 advisory. Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication...

Rocky Linux 10.2 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_69259)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669259 advisory. Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication...

MiracleLinux 8 : tomcat-9.0.120-1.el8_10 (AXSA:2026-1899:08)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1899:08 advisory. tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43512 tomcat-coyote: Apache Tomcat: HTTP/2 request headers no...

com.github.psi-probe:psi-probe-core (4.6.0), com.github.psi-probe:psi-probe-tomcat9 (>=4.6.0, <=4.7.0) +22 more potentially affected by CVE-2026-86350 via org.apache.tomcat:tomcat-coyote (>=9.0.118, <=9.0.121)

org.apache.tomcat:tomcat-coyote MAVEN version =9.0.118, =4.6.0, =3.0.120, =3.0.120, =3.0.120, =3.5.0, =9.0.118, =9.0.118, =9.0.118, =9.0.118, =8.0.36, =1.93.0, =1.93.0, =1.93.0, =1.2610.0 and more Source cves: CVE-2026-86350 Source advisory: MEND:CVE-2026-86350...

com.github.psi-probe:psi-probe-core (5.4.0), com.github.psi-probe:psi-probe-tomcat10 (5.4.0) +41 more potentially affected by CVE-2026-86350 via org.apache.tomcat:tomcat-coyote (>=10.1.55, <=10.1.59)

org.apache.tomcat:tomcat-coyote MAVEN version =10.1.55, =3.5.0, =10.1.55, =10.1.55, =10.1.55, =10.1.55, =10.1.59 - org.apache.tomee.bom:tomee-webprofile 10.2.0 - org.apache.tomee.maven:tomee-embedded-maven-plugin 10.2.0 - org.apache.tomee:apache-tomee 10.2.0 -...

org.apache.tomee.bom:tomee-webprofile (11.0.0-m1) potentially affected by CVE-2026-86248 via org.apache.tomcat:tomcat-coyote-ffm (11.0.22)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version 11.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-coyote-ffm and may be impacted: - org.apache.tomee.bom:tomee-webprofile 11.0.0-m1 Source cves: CVE-2026-86248 Source...

ch.qos.logback.access:logback-access-tomcat (>=2.0.7, <=2.0.15), codes.vps:tomcat-valve-request-filter (1.0) +120 more potentially affected by CVE-2026-77756 via org.apache.tomcat:tomcat-coyote (>=10.1.0-m1, <=10.1.59)

org.apache.tomcat:tomcat-coyote MAVEN version =10.1.0-m1, =2.0.7, =4.0.0, =1.0.0, =5.0.0, =5.0.0, =3.3.0, =0.2.0, =20260429, =20260429, =2.8.0, =3.1.0 - io.github.microsphere-projects:microsphere-spring-cloud-gateway 0.2.0 and more Source cves: CVE-2026-77756 Source advisory: MEND:CVE-2026-77756...

com.github.psi-probe:psi-probe-tomcat11 (>=5.0.0, <=5.4.0), com.github.waffle:waffle-tomcat11 (>=3.4.0, <=3.6.0) +76 more potentially affected by CVE-2026-77756 via org.apache.tomcat:tomcat-coyote (>=11.0.0-m1, <=11.0.25)

org.apache.tomcat:tomcat-coyote MAVEN version =11.0.0-m1, =5.0.0, =3.4.0, =2.5.8, =1.0-rc4, =1.2.0-rc3, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =1.0.25, =1.1.0 - io.yupiik.http:simple-native-http-server 1.0.2 and more Source cves: CVE-2026-77756 Source advisory: MEND:CVE-2026-77756...

codes.vps:tomcat-valve-request-filter (0.1), com.armanbilge:http4s-tomcat-server_2.12 (1.0-377-020cf9e) +136 more potentially affected by CVE-2026-77756 via org.apache.tomcat:tomcat-coyote (>=9.0.48, <=9.0.121)

org.apache.tomcat:tomcat-coyote MAVEN version =9.0.48, =3.0.11, =1.0.1, =1.7.0, =6.73, =3.5.5, =3.5.5, =3.1.0, =0.1.3, =1.7.2.230613, =1.8.3.240913 and more Source cves: CVE-2026-77756 Source advisory: MEND:CVE-2026-77756...

RLSA-2026:69259 Moderate: tomcat update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication...

RockyLinux 10 : tomcat update (Moderate) (RLSA-2026:69259)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69259 advisory. Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication...

AlmaLinux 10 : tomcat update (Medium) (ALSA-2026:69259)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69259 advisory. Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication...

tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

tomcat-coyote: tomcat: Improper Authorization allows security bypass

In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application...

tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated

Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid...

Moderate: Red Hat Security Advisory: tomcat update

An update for tomcat is now available for Red Hat Enterprise Linux 10.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

MiracleLinux 9 : tomcat-9.0.120-2.el9_8 (AXSA:2026-1883:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1883:07 advisory. Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat:...

ALSA-2026:69259 Moderate: tomcat update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication...

RockyLinux 10 : tomcat9 (RLSA-2026:68651)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:68651 advisory. Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication...