MGASA-2026-0376: tomcat Mageia

Vulnerability summary

MGASA-2026-0376 is a vulnerability in tomcat Mageia with no CVSS score yet.

Timeline

1. 04-09-2026
   PublishedVulnerability first disclosed.
2. 04-09-2026
   Last modifiedVulnerability information updated.

Description

Updated tomcat packages fix security vulnerabilities Incorrect URL decoding in RewriteValve may allow security control bypass. (CVE-2026-59083) EncryptInterceptor requirements not clearly documented. (CVE-2026-59084) DoS via WebSocket chat example. (CVE-2026-66299) Bypass longest prefix security constraint. (CVE-2026-65182) TOCTOU when setting specific permissions for Unix Domain Sockets. (CVE-2026-65183) HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete. (CVE-2026-65637) Limited replay attack possible with DIGEST authentication. (CVE-2026-65905) RewriteValve [N] restarts at the second rule and may bypass access control. (CVE-2026-65927) Servlet role references can bypass declarative role constraints. (CVE-2026-66422) Redirect after FORM auth may bypass method specific constraints. (CVE-2026-68525) Principal lookup can fail open in some cases. (CVE-2026-68569) DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset. (CVE-2026-68763) Authenticated WebSocket session survives end of HTTP session. (CVE-2026-73180)

No weakness data has been published for this record.