CLEANSTART-2026-QJ87848 Security fixes in tomcat10 9.0.58-r0

Package tomcat10 version 9.0.58-r0 fixes 1 vulnerabilities: CVE-2022-23181...

CLEANSTART-2026-KT93959 Security fixes in tomcat9 9.0.80-r0

Package tomcat9 version 9.0.80-r0 fixes 1 vulnerabilities: CVE-2023-41080...

CLEANSTART-2026-AG86451 Security fixes in tomcat9 9.0.68-r0

Package tomcat9 version 9.0.68-r0 fixes 1 vulnerabilities: CVE-2022-42252...

CLEANSTART-2026-LA63432 Security fixes in tomcat9 9.0.71-r0

Package tomcat9 version 9.0.71-r0 fixes 1 vulnerabilities: CVE-2023-24998...

CLEANSTART-2026-RO48475 Security fixes in tomcat11 9.0.64-r0

Package tomcat11 version 9.0.64-r0 fixes 1 vulnerabilities: CVE-2022-34305...

CLEANSTART-2026-ZK49637 Security fixes in tomcat10 10.0.27-r1

Package tomcat10 version 10.0.27-r1 fixes 2 vulnerabilities: CVE-2025-66614, CVE-2026-41293...

Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

SUSE-SU-2026:3419-1 Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

SUSE-SU-2026:3418-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Oth...

VulnCheck KEV: CVE-2026-34486

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the...

CVE-2026-59084

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

CVE-2026-59083

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

Security Bulletin: IBM Integration Bus for z/OS is vulnerable to Improper Handling of URL Encoding and Insufficient Technical Documentation due to Apache Tomcat (CVE-2026-59083 & CVE-2026-59084)

Summary IBM Integration Bus for z/OS is vulnerable to Improper Handling of URL Encoding and Insufficient Technical Documentation due to Apache Tomcat. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite...

Linux Distros Unpatched Vulnerability : CVE-2026-18047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. B...

Allocation of Resources Without Limits or Throttling

Overview org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WebSocket chat example. An attack...

Allocation of Resources Without Limits or Throttling

Overview org.apache.tomcat:tomcat-websocket is a Tomcat WebSocket JSR356 implementation. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WebSocket chat example. An attacker can exhaust system resources by sending a large number of...

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

DEBIAN-CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

UBUNTU-CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...