SUSE-SU-2026:1058-1

Advisory lineage Upstream: 43 Downstream: 0
Published: 26 Mar 2026, 09:46
Last modified:27 Mar 2026, 08:48

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

26 Mar 2026, 09:46
Published
Vulnerability first disclosed
27 Mar 2026, 08:48
Last Modified
Vulnerability information updated

Description

Security update for tomcat This update for tomcat fixes the following issues: Update to Tomcat 9.0.115: - CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895). - CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash (bsc#1246389). - CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318). - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371). - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385). - CVE-2023-44487: Rapid reset attack (bsc#1216182).

Affected Systems

  • suse•tomcat&distro=SUSE Linux Enterprise Server 12 SP5-LTSS

    < 9.0.115-3.160.1

  • suse•tomcat&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5

    < 9.0.115-3.160.1

References (51)