Security Bulletin: Vulnerabilities in Apache Tomcat Server library (CVE-2026-59083, CVE-2026-55956) affect Power HMC.

Summary The Apache Tomcat Server library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security...

Linux Distros Unpatched Vulnerability : CVE-2026-77281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and...

RLSA-2026:68677 Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43512 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-41293...

sslscan v2.2.3

sslscan2 sslscan version 2 has now been released. This includes a major rewrite of the backend scanning code, which means that it is no longer reliant on the version of OpenSSL for many checks. This means that it is possible to support legacy protocols SSLv2 and SSLv3, as well as supporting TLSv1...

Allocation of Resources Without Limits or Throttling

Overview github.com/caddyserver/caddy/v2/modules/caddyhttp/rewrite is a fast, multi-platform web server with automatic HTTPS Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the rewrite process when a placeholder in the URI template...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing

A flaw was found in Apache Tomcat's rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended...

tomcat9 security update

1:9.0.120-1 - Resolves: RHEL-192649 Tomcat9: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 - Resolves: RHEL-192818 Tomcat9: HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-219582 Tomcat9: Insufficient documentation for EncryptInterceptor may lea...

Oracle Linux 10 : tomcat9 (ELSA-2026-68651)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68651 advisory. - Resolves: RHEL-192649 Tomcat9: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 - Resolves: RHEL-192818 Tomcat9: HTTP/2...

Oracle Linux 9 : tomcat (ELSA-2026-68660)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68660 advisory. - Resolves: RHEL-192825 HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-192659 Improper Input Validation vulnerability due to...

AlmaLinux 8 : tomcat (ALSA-2026:68677)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68677 advisory. tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43512 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not...

Oracle Linux 8 : tomcat (ELSA-2026-68677)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68677 advisory. - Resolves: RHEL-192806 HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-219561 Security constraint bypass via improper URL encodi...

CVE-2026-77281

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite can pass attacker-controlled replacement bytes through...

UBUNTU-CVE-2026-77281

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite can pass attacker-controlled replacement bytes through...

CVE-2026-77281 Caddy: rewrite placeholder re-expansion

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite can pass attacker-controlled replacement bytes through...

CVE-2026-77281

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite can pass attacker-controlled replacement bytes through...

Security Bulletin: Vulnerability in Apache Tomcat affects DB2 Dev Extension (CVE-2026-59083, CVE-2026-59084)

Summary Upgraded tomcat-embed-core to 10.1.57 to remediate CVE-2026-59083 Security Constraint Bypass via URL hex-encoding and CVE-2026-59084 Insufficient EncryptInterceptor Documentation — CVSS Base Score 9.1 Critical — PVR0818163. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve

A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will...

Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing

A flaw was found in Apache Tomcat's rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended...