MGASA-2026-0479 Updated tomcat package fixes security vulnerabilities

OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. CVE-2026-73581 Cross-context authentication mix-up with Jakarta Authentication configured. CVE-2026-75973 Bypass of security constraints for WebSocket endpoints. CVE-2026-76183 Transfer-Encoding honored for...

Updated tomcat package fixes security vulnerabilities

OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. CVE-2026-73581 Cross-context authentication mix-up with Jakarta Authentication configured. CVE-2026-75973 Bypass of security constraints for WebSocket endpoints. CVE-2026-76183 Transfer-Encoding honored for...

BIT-TOMCAT-2026-87022 Apache Tomcat: WebSocket message smuggling with per-message-deflate

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.0 through 10.1.59, from 9.0.0 through 9.0.121. The following versions we...

PT-2026-105214

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.0 through 10.1.59, from 9.0.0 through 9.0.121. The following versions we...

CVE-2026-87022

A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the 'per-message-deflate' extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into...

SUSE CVE-2026-87022

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

Linux Distros Unpatched Vulnerability : CVE-2026-87022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This iss...

CVE-2026-87022

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

DEBIAN-CVE-2026-87022

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

CVE-2026-87022

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

UBUNTU-CVE-2026-87022

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

CVE-2026-87022 Apache Tomcat: WebSocket message smuggling with per-message-deflate

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

CVE-2026-87022 Apache Tomcat: WebSocket message smuggling with per-message-deflate

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

CVE-2026-87022

Apache Tomcat is vulnerable to WebSocket message smuggling due to an improper handling of length parameter inconsistency when the per-message-deflate feature is enabled. This vulnerability affects versions 11.0.0-M1 through 11.0.25 , 10.1.0-M1 through 10.1.59 , and 9.0.0.M1 through 9.0.121 . Addi...

CVE-2026-87022

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

EUVD-2026-85236

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

CVE-2026-87022: Improper Handling of Length Parameter Inconsistency

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...

tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling

A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the 'per-message-deflate' extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into...

tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling

A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the 'per-message-deflate' extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into...

Fixed in Apache Tomcat 9.0.122

Low: WebSocket message smuggling with per-message-deflate CVE-2026-87022 Improper handling of length parameter allows WebSocket message smuggling when per-message-deflate is used. This was fixed with commit 959a52a2. This issue was reported to the Tomcat security team on 7 September 2026. The iss...