tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation

In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service DoS, making the affected system unavailable to legitimate user...

tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy

A flaw was found in Apache Tomcat. The AJP secret was comparable in non-constant time, allowing an attacker on the local network to mount a timing attack to determine the AJP secret, which may lead to unauthorized access or other security bypasses...

Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing

A flaw was found in Apache Tomcat's rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended...

tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated

Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid...

tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm

In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy

A flaw was found in Apache Tomcat. The AJP secret was comparable in non-constant time, allowing an attacker on the local network to mount a timing attack to determine the AJP secret, which may lead to unauthorized access or other security bypasses...

tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources...

tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation

In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service DoS, making the affected system unavailable to legitimate user...

tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated

Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid...

Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing

A flaw was found in Apache Tomcat's rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended...

RLSA-2026:41906 Important: httpd security, bug fix, and enhancement update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix for CVE-2023-38709 CVE-2024-42516 Apache HTTP Server: modrewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation CVE-2026-24072 http...

httpd security, bug fix, and enhancement update

An update is available for httpd. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful, efficient, and...

Apache OFBiz Directory Traversal - Remote Code Execution

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.13 id: CVE-2024-32113 info: name: Apache OFBiz Directory Traversal - Remote Code Execution author: DhiyaneshDK severity: high description: |...

EUVD-2026-46777

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: Apache Plugin. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server...

OPENSUSE-SU-2026:11326-1 apache-ivy-2.6.0-1.1 on GA media

These are all security issues fixed in the apache-ivy-2.6.0-1.1 package on the GA media of openSUSE Tumbleweed...

TencentOS Server 3: httpd:2.4 (TSSA-2026:0732)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0732 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

httpd:2.4 security, bug fix, and enhancement update

httpd 2.4.37-65.0.1.8 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65.8 - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointe...