OPENSUSE-SU-2026:20612-1: tomcat10&distro=openSUSE Leap 16.0 openSUSE

CVSS: UnknownPublished

Published 22-04-2026Last modified 24-04-2026

Open JSON

Vulnerability summary

OPENSUSE-SU-2026:20612-1 is a vulnerability in tomcat10&distro=openSUSE Leap 16.0 openSUSE with no CVSS score yet.

Overall risk

0/100

0100

Minimal · default modelHow is this calculated?

CVSS score

Not scored

010

No CVSS score recorded

EPSS score

Not scored

0%100%

No EPSS score yet

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 11 · Downstream 0 · Related 11

CVE-2025-66614 CVE-2026-24880 CVE-2026-25854 CVE-2026-29129 CVE-2026-29145 CVE-2026-29146+5 more

Timeline

22-04-2026
PublishedVulnerability first disclosed.
24-04-2026
Last modifiedVulnerability information updated.

Description

Security update for tomcat10 This update for tomcat10 fixes the following issues: - Update to Tomcat 10.1.54 - CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850). - CVE-2026-25854: Occasionally open redirect (bsc#1261851). - CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852). - CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853). - CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854). - CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855). - CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856). - CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857). - CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Opensuse1 product

tomcat10&distro=openSUSE Leap 16.0< 10.1.54-160000.1.1

1 vendor · 1 product