SUSE-SU-2026:1058-1: tomcat&distro=SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise

Published

Published 26-03-2026Last modified 27-03-2026

Vulnerability summary

SUSE-SU-2026:1058-1 is a vulnerability in tomcat&distro=SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise with no CVSS score yet.

Priority

Insufficient evidence

No CVSS vector published; no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

Not scored

010

No CVSS score recorded

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

26-03-2026
PublishedVulnerability first disclosed.
27-03-2026
Last modifiedVulnerability information updated.

Description

Security update for tomcat This update for tomcat fixes the following issues: Update to Tomcat 9.0.115: - CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895). - CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash (bsc#1246389). - CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318). - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371). - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385). - CVE-2023-44487: Rapid reset attack (bsc#1216182).

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: not stated in public data.

Suse2 products

tomcat&distro=SUSE Linux Enterprise Server 12 SP5-LTSS< 9.0.115-3.160.1
tomcat&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 9.0.115-3.160.1

1 vendor · 2 products

References

51 links

www.suse.com/support/update/announcement/2026/suse-su-20261058-1/Advisory
bugzilla.suse.com/1216182REPORT
bugzilla.suse.com/1243895REPORT
bugzilla.suse.com/1246318REPORT
bugzilla.suse.com/1246389REPORT
bugzilla.suse.com/1258371REPORT
bugzilla.suse.com/1258385REPORT
bugzilla.suse.com/1259224REPORT
www.suse.com/security/cve/CVE-2020-13934WEB
www.suse.com/security/cve/CVE-2020-13935WEB

Show all 51 references

Related vulnerabilities

Insufficient evidenceSUSE-SU-2026:4927-1SUSE Linux Enterprisesuse · libapr1&distro=SUSE Linux Enterprise Server 12 SP5-LTSS +5 more5d agosuse libapr1&distro=SUSE Linux Enterprise Server 12 SP5-LTSSSecurity update for libapr1, libtcnative-1-0, tomcat This update for libapr1, libtcnative-1-0, tomcat fixes the following issues: - CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore (bsc#1282631). - CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure (bsc#1286502). - CVE-2026-74049: Jasper JSTL <c:redirect> plug-in implementation omits page abort (bsc#1286555). - CVE-2026-75973: improper authentication when Jakarta authentication is configured with `SimpleAuthConfigProvider` (bsc#1282630). - CVE-2026-76183: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629). - CVE-2026-77756: inconsistent interpretation of HTTP requests allows an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy (bsc#1282628). - CVE-2026-77762: stale HPACK emitter injects trailers fields into another HTTP/2 request (bsc#1282599). - CVE-2026-77791: uncontrolled resource consumption when sending WebSocket close message enabled a DoS attack (bsc#1282627). - CVE-2026-78383: allocation of resources without limits or throttling allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service (bsc#1282626). - CVE-2026-78437: incomplete cleanup allows a malformed request to potentially cause requests from another user to fail (bsc#1282625). - CVE-2026-79677: missing release of resource after effective lifetime and comparison using wrong factors allows for denial of service due to lost time outs for asynchronous WebSocket writes (bsc#1282624). - CVE-2026-80353: TOCTOU when creating unix domain sockets for the APR/Native connector allows an unauthorized local user to access the unix domain socket (bsc#1286902). - CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash (bsc#1282623). - CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622). - CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for some configurations (bsc#1282621). - CVE-2026-86248: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled (bsc#1282620). - CVE-2026-86350: HTTP/2 requests can cause request header mix-ups and HTTP request smuggling (bsc#1282787). - CVE-2026-87022: WebSocket message smuggling when per-message-deflate is used (bsc#1282581). - CVE-2026-88041: Information disclosure via incomplete HTTP trailer cleanup (bsc#1286559). - CVE-2026-93446: Possible TLS 1.3 connection failures (bsc#1286571). - CVE-2026-101296: Authentication bypass via non-GSSAPI SASL in JNDI realm (bsc#1286361). - CVE-2026-101356: Information disclosure via incorrect object recycling in HTTP/2 processing (bsc#1286362). Non security issue fixed: - Tomcat TLS Broken - Tomcat 9.0.14 update incompatible with tomcat-native (bsc#1130843). Changes for libapr1: Update to 1.6.5: + Fix Win32 build breakage in apr_os_exp_time_put() in 1.6.4 + Fix apr_parse_addr_port() regression in scope_id parsing introduced in 1.6.3 + Numerous corrections to APR poll behavior + apr_file_trunc: Truncating a buffered file could add unexpected data after the truncate position + apr_file_trunc: Fix an issue where reading from a buffered file after truncate could return stale data from the buffer + apr_ipsubnet_create() now fails for an empty input string + Fix CVE-2017-12613, out-of-bounds read in apr_time_exp*() + Export build files find_apr.m4 and apr_common.m4 + apr_proc_mutex-pthread: Refcount shared mutexes usage to avoid destruction while still in use by some process(es) + New APIs: apr_allocator_align(), apr_os_proc_mutex_put_ex(), apr_os_proc_mutex_get_ex(), apr_os_proc_mutex_set_ex(), apr_file_pipe_create_pools(), apr_pollcb_wakeup(), apr_pollcb_method_name(), apr_cstr_*(), apr_skiplist_addne*(), apr_skiplist_size(), apr_skiplist_height(), apr_skiplist_preheight(), apr_skiplist_set_preheight(), apr_skiplist_add(), apr_sockaddr_info_copy(), apr_shm_delete(), apr_escape_ldap() and apr_pescape_ldap() + Add APR_OVERLAP_TABLES_ADD, APR_SO_FREEBIND and the APR_PERMS_SET macros + Add Unix domain socket support + New configure options --enable-allocator-guard-pages and --enable-pool-concurrency-check Changes for libtcnative-1-0: - Update to 1.3.9 * Security fixes + Client certificate requirements can be down-graded (bsc#1282621, CVE-2026-86247) A race condition allowed client certificate verification requirements to be down-graded for some configurations. + Insecure OpenSSL options enabled (bsc#1282622, CVE-2026-86246) Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. + DoS via TLS handshake (bsc#1282623, CVE-2026-86243) A buffer over-read vulnerability in Apache Tomcat Native during the TLS handshaking permits a malicious user to trigger a DoS via a JVM crash. * Changes + Code: Remove call to ERR_remove_thread_state() from Windows specific code to allow building with OpenSSL 4.0.x. ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got removed in OpenSSL 4 + Fix: Fix a potential crash when negotiating ALPN + If ALPN negotiation fails and failure is configured to use the last server protocol in the list, use it rather than the last protocol offered by the client + Fix: Add support for the extended range of options available from OpenSSL 3.0.x. The options flag is now a 64-bit unsigned int (represented by a Java long) rather than a 32-bit unsigned int (represented by a Java int) + Code: Remove unused code + Ensure that per connection changes to certificate verification settings, e.g. to support client certificate authentication, do not modify the certificate verification settings for other connections + Fix: Fix a potential crash when configuring raw certificates + Fix: Avoid a potential crash with very long ALPN protocol names + Fix: Make the call to a CertificateVerifier more robust + Fix: Avoid a potential crash when processing OCSP URLs + Fix: Make the processing of OCSP responses more robust + Fix: Stricter OCSP handling when soft-fail is disabled + Fix: Harden against the mis-use of Buffer.address(ByteBuffer) + Fix: Harden against the mis-use of Pool.destroy(long) + Code: The minimum supported OpenSSL version is now 3.0.x. OpenSSL 1.1.1 support was accidentally broken in 1.3.8. As no bug reports were receive for that failure and since both Debian and Ubuntu versions that used OpenSSL 1.1.1 have reached end of support, OpenSSL 1.1.1 is no longer supported + Update: OpenSSL 3.0.x is approaching end of support so the recommended version of OpenSSL (and the version that windows binaries will be built with) now follows the 3.5.x LTS branch + Fix: Switch to automatic configuration of DH parameters. Manual configuration attempts will be ignored + Code: Make setTmpECDHByCurveName() a NO-OP + Fix: Refactor extraction of ECDH curve name from the Certificate to avoid deprecated OpenSSL methods + Fix: Refactor the native implementation of SSL.getTime() to avoid the Y2038 problem in SSL_SESSION_get_time() when running on a verion of OpenSSL that includes the new SSL_SESSION_get_time_ex() method + restore openssl 1.1.1 support - Update to 1.3.8 + Fix a memory leak when parsing certificates + Fix two potential memory leaks on error paths identified by Copilot + Fix post handshake authentication when Tomcat is configured with a trust store using JSSE style configuration + Correct expected size of tickets when calling SSLContext.setSessionTicketKeys - Update to 1.3.7: [bsc#1260322] 1.3.7 * Code: Refactor access to ASN1_OCTET_STRING to use setters to fix errors when building against the latest OpenSSL 4.0.x code. (markt) * Fix: Fix the handling of OCSP requests with multiple responder URIs. (jfclere) * Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when soft fail is disabled. (jfclere) 1.3.6 * Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL and SSL_CTX clean-up. (markt) * Fix: Fix unnecessarily large buffer allocation when filtering out NULL and export ciphers. Pull requests #35 and #37 provided by chenjp. (markt) * Fix: Fix a potential memory leak if an invalid OpenSSLConf is provided. Pull request #36 provided by chenjp. (markt) * Fix: Refactor setting of OCSP configuration defaults as they were only applied if the SSL_CONF_CTX was used. While one was always used with Tomcat versions aware of the OCSP configuration options, one was not always used with Tomcat versions unaware of the OCSP configuration options leading to OCSP verification being enabled by default when the expected behaviour was disabled by default. (markt) * Code: Improve performance for the rare case of handling large OCSP responses. (markt) 1.3.5 * Fix: Remove group write permissions from the files in the tar.gz source archive. (markt) * Fix: Clear an additional error in OCSP processing that was preventing OCSP soft fail working with Tomcat's APR/native connector. (markt) 1.3.4 * Fix: Correct logic error that prevented the configuration of TLS 1.3 cipher suites. (markt) 1.3.3 * Fix: Refactor the addition of TLS 1.3 cipher suite configuration to avoid a regression when running a version of Tomcat that pre-dates this change. (markt) 1.3.2 * Update: Rename configure.in to modern autotools style configure.ac. (rjung) * Update: Fix incomplete updates for autotools generated files during 'buildconf' execution. (rjung) * Update: Improve quoting in tcnative.m4. (rjung) * Update: Update the minimum version of autoconf for releasing to 2.68. * Fix: Fix the autoconf warnings when creating a release. (markt) * Update: The Windows binaries are now built with OCSP support enabled by default. (markt) * Add: Include a nonce with OCSP requests and check the nonce, if any, in the OCSP response. (markt) * Add: Expand verification of OCSP responses. (markt) * Add: Add the ability to configure the OCSP checks to soft-fail - i.e. if the responder cannot be contacted or fails to respond in a timely manner the OCSP check will not fail. (markt) * Add: Add a configurable timeout to the writing of OCSP requests and reading of OCSP responses. (markt) * Add: Add the ability to control the OCSP verification flags. (markt) * Add: Configure TLS 1.3 connections from the provided ciphers list as well as connections using TLS 1.2 and earlier. Pull request provided by gastush. (markt) * Update: Update the Windows build environment to use Visual Studio 2022. (markt) 1.3.1 * Fix: Fix a crash on Windows when SSLContext.setCACertificate() is invoked with a null value for caCertificateFile and a non-null value for caCertificatePath until properly addressed with https://github.com/openssl/openssl/issues/24416. (michaelo) * Add: Use ERR_error_string_n with a definite buffer length as a named constant. (schultz) * Add: Ensure local reference capacity is available when creating new arrays and Strings. (schultz) * Update: Update the recommended minimum version of OpenSSL to 3.0.14. 1.3.0 * Update: Drop useless compile.optimize option. (michaelo) * Update: Align Java source compile configuration with Tomcat. (michaelo) * Fix: Fix version set in DLL header on Windows. (michaelo) * Update: Remove an unreachable if condition around CRLs in sslcontext.c. (michaelo) * Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(), the default verify paths are no longer set. Only the explicitly configured trust store, if any, will be used. (michaelo) * Update: Update the minimum supported version of LibreSSL to 3.5.2. * Design: Remove NPN support as NPN was never standardised and browser support was removed in 2019. (markt) * Update: Update the recommended minimum version of OpenSSL to 3.0.13. - Fix build after removal of the default %%{java_home} define - Update to 1.2.39: * Fix: 67061: If the insecure optionalNoCA certificate verification mode is used, disable OCSP if enabled else client certificates from unknown certificate authorities will be rejected. * Update: Update the recommended minimum version of OpenSSL to 3.0.11. * Change the hardcoded libopenssl-1_1-devel to libopenssl-devel for distributions that have the right version - Version update to version 1.2.38: * Align default pass phrase prompt with HTTPd. * #66669: Fix memory leak in SNI processing. * Update the recommended minimum version of OpenSSL to 1.1.1v. * Update the recommended minimum version of APR to 1.7.4. * Document the TLS rengotiation behaviour. * Add HOWTO-RELEASE.txt that describes the release process. * Refactor library initialization so it is compatible with Tomcat 10.1.x onwards where a number of Java classes have been removed. * Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to allow clients to determine if the FIPS provider is being used when Tomcat Native is compiled against OpenSSL 3.x. * #66035: Fix crash when attempting to read TLS session ID after a handshake failure. * Enable download_deps.sh to be called from any directory. * Fix release script so it works with the current git layout. * #65441: Correct previous fix that enabled building to continue with OpenSSL 3.x. * #65659: Remove remaining reference to pkg-config which is no longer included in the Tomcat Native distribution. * #65181: Additional changes required to provided support for using OpenSSL Engines that use proprietary key formats. * #65329: Correct handling of WINVER in make file to use correct constant for Windows 7. Add constants for Windows 8, Windows 8.1 and Windows 10. Rename WINNT to WIN2k as it is used for Windows 2000 upwards, not Windows NT upwards. * Add a patch for APR that fixes an issue where some Windows systems in some configurations would only listen on IPv6 addresses on dual stack systems even though configured to listen on both IPv6 and IPv4 addresses. * Correct a regression in the fix for 65181 that prevented an error message from being displayed if an invalid key file was provided and no OpenSSL Engine was configured. * #65181: Improve support for using OpenSSL Engines that use proprietary key formats. * Enable building to continue against OpenSSL 3.x and 1.1.1. * Incomplete name mangling fix for C++ compilers in tcn_api.h. * Improve OS-specific header include for native thread id. * Disable keylog callback support for LibreSSL. * Add support for SSLContext.addChainCertificateRaw() with LibreSSL 2.9.1 and up. * Add support for HP-UX's _lwp_self() in our ssl_thread_id(void). * Remove default option passed for rpath to linker on HP-UX. * Add an option to allow the OCSP responder check to be bypassed. Note that if OCSP is enabled, a missing responder is now treated as an error. * #64429: Fix compilation with LibreSSL. * #63671: libtcnative does not compile with OpenSSL < 1.1.0 and APR w/o threading support. * Correct configure message for OpenSSL libdir. * #64260: Clean up install target. * #64315: configure output for OpenSSL wrong/incomplete sometimes. * Drop obsolete build time workarounds for HP-UX. * Add support for FreeBSD's pthread_getthreadid_np() in our ssl_thread_id(void). * #64316: Introduce tcn_get_thread_id(void) to reduce code duplication. * Fix linking against OpenSSL in non-standard locations on FreeBSD. - Add GPG keyring. - Version update to version 1.2.23: * See changelog.html for in-depth upstream changes - Version update to version 1.2.21: * Fix incompatibility with Tomcat (bsc#1130843) - Version update to version 1.2.16: * Fixes build breakage with newer version of openssl - Version update to version 1.2.4: * This connector to properly work requires openssl 1.0.2 or newer so do not backport to other codestreams. - Remove keyring file as there is new keyring and I didn't find it on the web - Update to version 1.1.32 * Fix: 53952: Add support for TLSv1.2 and TLSv1.1. * Fix: 56844: Use OpenSSL 1.0.1j with Windows binaries. * Update: Use APR 1.5.1 with Windows binaries - version 1.1.30 * Fixed double-free in ssl_ocsp_request. Patch provided by Aristotelis. * Other minor bugfixes. Changes for tomcat: Update to Tomcat 9.0.123 * Catalina + Fix: When starting a web application, don't try and use the web application class loader until after the web application class loader has started. (markt) + Fix: various concurrency issues around adding and removing Realms from a CombinedRealm, in particular doing so while the CombinedRealm is in use. Note that once a Realm instance has been removed from a CombinedRealm instance at run-time, the removed Realm instance may not be reused apart from re-adding it to the same CombinedRealm. (markt) + Update: When StoreConfig re-writes an existing server.xml or context configuration file, preserve the layout of the existing file (comments, blank lines and attribute order) on a best effort basis. (remm) + Fix: Track in StandardContext whether the context was deployed from a Context element in server.xml. Use it to have StoreConfig save to a new config file. (remm) + Fix: Improve error handling on start-up. (markt) + Fix: byte range responses generated by DefaultServlet so a short resource stream read does not truncate the response. Treat a premature end of stream as an I/O error. Based on pull request #1067 by aoto-tech. (markt) + Fix: Align OpenSSLLifecycleListener with AprLifecycleListener and throw an Error when FIPS is requested but not available. (markt) + Fix: Ensure that, as per the documentation, a simple bind is always used when the JNDI realm binds using the user provided name and password to authenticate the user. (markt) + Update: Optimize Accept-Language header processing and use of resource budles for localization. (remm) * Coyote + Fix: 70236: Fix a stalled TLS handshake with the OpenSSL based implementations of SSLEngine when the first flight of handshake messages sent by the server is too large to fit in the buffer used by the BIO pair. Patch submitted by Lukas Hellebrandt. (remm) + Fix: #1073: Fix possible corruption when using HTTP/2 and async IO on uploads. Submitted by Tim Burke. (remm) + Fix: Avoid very rare race between async write notification and completion. Skip the write notification in these cases since it would be useless. (remm) + Fix: a timing issue that could cause large non-blocking writes to stall for AJP connections. (markt) + Fix: Ensure that the non-blocking write buffer is empty before sending an AJP end response message. (markt) + Fix: CharChunk.indexOf(char) so that it searches from the start of the chunk rather than from twice the chunk's start offset when the chunk does not begin at the start of its buffer. (breken-ai) + Fix: 70247: Fix a leak in the HTTP/2 connection flow control window when part of the HTTP request body is received but not read. Based on a patch provided by Guillaume Darmont. (markt) + Fix: 70251: Avoid closing a JarFile in CloseableURLConnection unless it is certain the JAR is not shared. (remm) + Fix: possible corruption of HTTP/1.1 chunked response bodies if a previous write to a chunked body fails. (markt) + Fix: Align cipher order with the results produced by OpenSSL if the cipher specification adds, removes and then re-adds ciphers. (markt) + Add: new attributes (unixDomainSocketParentPermissions and unixDomainSocketParentOwner) to the APR/Native connector to provide additional control over the security of Unix Domain Sockets. Additional checks (enabled by default) have also been added for the directory where the Unix Domain Socket will be created.(markt) + Fix: Correct a narrow race condition when processing HTTP/2 headers. + Fix: possible TLS connections failures caused by one of the flags Tomcat uses to track TLS handshake progress not being correctly reset. (markt) + Fix: Allow for absolute host names in SNI checks. (markt) + Fix: Correct a gap in asynchronous error handling that could lead to unexpected IllegalStateExceptions for some error conditions. (markt) + Add: Harden HTTP/2 against applications that do not correctly handle asynchronous errors. (markt) * Jasper + Fix: Route JspC servlet context logging through Ant when used as an Ant task. (sainadh777) + Fix: the tag plugin for the JSTL <c:redirtect> tag so that page processing ends with the redirect. (markt) * Web applications + Add: Documentation: Explicitly state that virtual host matching via the HTTP host header and TLS configuration matching via SNI are completely separate processes. (markt) + Fix: Examples: Draw axis-aligned rectangles and ellipses as lines in the WebSocket drawboard. (sainadh777) * Other + Update: the internal fork of Apache Commons BCEL to 6.13.0. (markt) + Update: to NSIS 3.13. (markt) + Update: to Byte Buddy 1.18.14. (markt) + Update: to Bouncy Castle 1.8.6. (markt) + Add: Improvements to French translations. (remm) + Add: Improvements to Japanese translations provided by tak7iji. (markt) * Cluster + Fix: Replicate SSO session key set changes made by removeSession() and sessionChangedId() in ClusterSingleSignOn so that SSO entries are correctly deregistered and removed from all nodes when the last associated session expires, even when the sessions expire on different cluster nodes. (remm) + Fix: Move context attributes that were set while the web application was still starting into the replicated attribute map when it is installed in ReplicatedContext, so that they are replicated to the other nodes like attributes set later on rather than remaining local to the node that started the application. (remm) + Fix: a possible deadlock in DeltaSession.expire(): the final session delta is now captured and sent to the cluster before the session monitor is acquired, because obtaining the delta takes the delta lock and code that runs while the delta lock is held, such as session attribute listener notifications, may in turn wait for the session monitor. (remm) + Fix: Fire the documented send_message_failure lifecycle event with the message, destination and exception when a SimpleTcpCluster message send fails and notifyLifecycleListenerOnFailure is enabled. The event was previously declared but never fired. (remm) + Fix: a possible deadlock in DeltaSession: session attribute listeners are no longer called while the delta lock is held when attributes are set or removed. The delta lock is only held while the change is recorded. (markt) + Fix: a possible deadlock in DeltaSession: received session deltas are now read into a separate DeltaRequest from the one the session uses to record local changes. This avoids having to hold the delta lock while processing received changes. (markt) + Fix: an issue replicating SessionListener additions and removals that meant some modification were not replicated leading to inconsistent listener configurations across the cluster. (markt) * Tribes + Docs: Document Tribes channel, membership, transport and replication status available through JMX. Based on pull request #1071 by sainadh777. + Fix: Improve the handling of AsyncContext.dispatch() when the Context attribute dispatchersUseEncodedPaths is set to false since the application has no control over the path used for the AsyncContext.dispatch(). Prior to this fix, paths containing literal '?' characters were truncated. (markt) + Fix: Ensure that capture groups from a RewriteCond always reflect the result of the current request. (markt) + Fix: When a PersistentManager needs to reduce the number of active sessions, swap out the least recently used eligible sessions first. Pull request #1045 provided by sainadh777. (markt) + Fix: Align web.xml logging output with the new Context attribute urlPatternsProvidedInDecodedForm. (markt) + Fix: Improve robustness of DIGEST authentication to system clock jumps. + Add: Support multiple protocol header values (treat as a single merged header value) in the RemoteIpFilter and RemoteIpValve. (markt) + Fix: potential concurrency issues when loading/saving sessions from/to a session store. Custom Store implementations that do not extend StoreBase must implement the new getSessionStoreLock() method of the Store interface to ensure concurrency protection. The default method implementation provided only provides the pre-fix functionality. (markt) + Fix: Ensure that PersistentManager implementations that extend PersistentManagerBase do not swap out sessions that are associated with a request that is currently being processed. As a result, it is now a requirement that the system property org.apache.catalina.session.StandardSession.ACTIVITY_CHECK is set to true (either explicitly or via STRICT_SERVLET_COMPLIANCE) if either minIdleSwap or maxIdleSwap are configured. (markt) + Fix: xreflection generated code stack overflow issue. (remm) + Fix: Align xreflection better with IntrospectionUtils. (remm) + Fix: In HTTP/2 after half closed (remote), any unexpected frame should be a stream error. (remm) + Fix: incorrect initial window size calculation when upgrading to HTTP/2. (remm) + Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm) + Fix: Only try and load the native library from the CATALINA_HOME system property when the property is set. (markt) + Fix: max connections enforcement after an enpoint resume. (remm) + Fix: Implement stricter ALPN matching for Connectors using FFM. (markt) + Add: length validation for ALPN protocol names. (markt) + Fix: Make FFM certificate verification more robust. (markt) + Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing failure as if no usable OCSP URLs were present. (markt) + Fix: Make the processing of OCSP responses more robust. (markt) + Fix: Stricter OCSP handling when soft-fail is disabled. (markt) + Fix: Cleaner handling of AJP response headers which overflow the maximum message size. (remm) + Fix: Small per performance optimisation. Don't waste cycles swallowing an AJP response body when the connection is going to be closed. (markt) + Fix: OpenSSL support for CRLs when using OpenSSL trust with the server key held in a Java key store. (markt) + Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding header. (markt) + Fix: Ensure per request HTTP/2 bad request marker is cleared when the request is recycled. (markt) + Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt) + Fix: Revert earlier refactoring of HTTP/2 header field validation that moved it earlier since the refactoring made correct handling of invalid headers more difficult. (markt) + Fix: EL evaluation of some lambda expressions. (remm) * WebSocket + Fix: an exception when an automatic Pong response races with the closing of the WebSocket session. (moritzfl) + Fix: Harden the WebSocket client and use a SecureRandom when generating the Sec-WebSocket-Key header. (markt) + Fix: Improve robustness of client handshakes. (remm) + Fix: Ensure that WebSocket write timeouts apply to the complete message and are not lost if two writes have the same timeout. (markt) + Fix: Reduce CPU usage while sending WebSocket close message. (markt) + Fix: overly broad check that prevented request URIs containing literal { and } characters from being mapped to WebSocket end points. (markt) + Fix: handling of WebSocket messages with compressed payloads using per- message-deflate that have one or more non-final blocks where the BFINAL bit is set. (markt) + Fix: handling of per-message-deflate context takeover when receiving compressed WebSocket messages. (markt) + Fix: Manager: Fix a potential concurrency issue when ordering sessions prior to displaying a list of session. (markt) + Docs: Wrap the RewriteRule regular expression syntax reference on narrow displays. Pull request #1044 by sainadh777. (markt) + Update: Easymock to 5.7.0. (markt) + Update: bnd to 7.4.0. (markt) + Update: Tomcat Native to 1.3.9. (markt) + Add: Improvements to Japanese translations provided by tak7iji and Ktamura.biz.80. (markt) + Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a positive integer. Zero or negative values previously caused an infinite loop or a NegativeArraySizeException during session state transfer. Pull request #1042 provided by lihongyi87. (markt) + Fix: Improve robustness of cloud membership providers if an error occurs fetching members. (remm) * jdbc-pool + Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to getConnection(String,String) rather than getConnection(). (markt) + Add: Log a warning if an attempt is made to obtain a connection with credentials when alternateUsernameAllowed is set to false. (markt) + Fix: Ensure StatementCache interceptor resets properties of cached statements between uses. (mark)CVSSUnscored Insufficient evidenceSUSE-SU-2026:4126-1SUSE Linux Enterprisesuse · tomcat&distro=SUSE Linux Enterprise Server 12 SP5-LTSS +1 more1mo agosuse tomcat&distro=SUSE Linux Enterprise Server 12 SP5-LTSSSecurity update for tomcat This update for tomcat fixes the following issues: - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint (bsc#1276893). - CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets (bsc#1276894). - CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - fix incomplete (bsc#1276895). - CVE-2026-65905: Apache Tomcat: Limited replay attack possible with DIGEST authentication (bsc#1276896). - CVE-2026-65927: Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control (bsc#1276897). - CVE-2026-66299: memory exhaustion via maliciously slow clients due to the WebSocket chat example providing an unbounded buffer for undelivered messages (bsc#1273150). - CVE-2026-66422: Apache Tomcat: Servlet role references can bypass declarative role constraints (bsc#1276898). - CVE-2026-68525: Apache Tomcat: Redirect after FORM auth may bypass method specific constraints (bsc#1276899). - CVE-2026-68569: Apache Tomcat: Principal lookup can fail open in some cases (bsc#1276900). - CVE-2026-68763: Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset (bsc#1276901). - CVE-2026-73180: Apache Tomcat: Authenticated WebSocket session survives end of HTTP session (bsc#1276902). Changes for tomcat: - Updated to version 9.0.121CVSSUnscored Insufficient evidenceSUSE-SU-2026:3440-1SUSE Linux Enterprisesuse · tomcat&distro=SUSE Linux Enterprise Server 12 SP5-LTSS +1 more3mo agosuse tomcat&distro=SUSE Linux Enterprise Server 12 SP5-LTSSSecurity update for tomcat This update for tomcat fixes the following issues: Update to Tomcat 9.0.120: Security issues fixed: - CVE-2026-59083: incorrect URL decoding in `RewriteValve` may allow security control bypass (bsc#1271397). - CVE-2026-59084: `EncryptInterceptor` requirements are not clearly documented (bsc#1271398). Other updates and bugfixes: - Tomcat 9.0.120: * Catalina + Fix: Avoid a race condition with concurrent lookups for a singleton JNDI resource. (markt) + Fix: Improve the performance of range validation for the default servlet. (markt) + Fix: Avoid NPE in RewriteValve. (markt) + Fix: 70127: Fix use of Bootstrap through reflection by restoring the public constructor. Use through scripts was not affected. (remm) + Fix: Restore ability to extend many element classes from AbstractAccessLogValve. (remm) + Fix: Align DIGEST authentication with RFC 7616 and require clients to provide a valid qop parameter. (markt) + Fix: Use Files API to create temporary docBase when antiLockingDocBase is enabled. (markt) + Fix: Improve validation of configuration when DataSourceRealm starts. (remm) + Fix: JAASRealm should do a logout if login does not fail outright but does not produce a Principal. (remm) + Fix: Various edge cases for SSI substitutions, quoting and escaping. + Fix: unintentional conversion of literal + to a space during rule processing in the RewriteValve. (markt) * Coyote + Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native is not available when the connector is explicitly configured to use Tomcat Native with OpenSSL for TLS. (markt) + Fix: Correct a regression introduced in 9.0.119 that broke reading of some request bodies via a Reader. (markt) * Jasper + Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix for 69333) was incomplete and tags that threw exceptions in doStartTag() and doEndTag() were incorrectly re-used. This fix prevents tags from being re-used if such an exception occurs. (markt) + Fix: 70135: Fix security classload regression. (remm) + Add: support for specifying Java 28 (with the value 28) as the compiler source and/or compiler target for JSP compilation. If used with an Eclipse JDT compiler version that does not support these values, a warning will be logged and the default will be used. (markt) * WebSocket + Fix: 70126: Fix WebSocket extension permessage-deflate so that it does not drop bytes if a compressed message inflates to more than the available buffer. Fix written by GPT-5.5. Test case written by Hironori Ichimiya. (markt) + Fix: Optimise WebSocket client processing of server responses during WebSocket HTTP upgrade process. (markt) * Other + Update: Byte Buddy to 1.18.9. (markt) + Update: UnboundID to 7.0.5. (markt) + Update: JaCoCo to 0.8.15. (markt) + Update: BND to 7.3.0. (markt) + Add: Improvements to French translations. (remm) + Add: Improvements to Japanese translations provided by tak7iji. (markt)CVSSUnscored Insufficient evidenceSUSE-SU-2026:3167-1SUSE Linux Enterprisesuse · tomcat&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP53mo agosuse tomcat&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5Security update for tomcat This update for tomcat fixes the following issues Update to Tomcat 9.0.119. Security issues fixed: - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791). - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be skipped if the first condition in an OR chain matched (bsc#1269910). - CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824). - CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints to not be included when the effective web.xml was logged (bsc#1269909). - CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster component (bsc#1269908). - CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint (bsc#1269907). Other updates and bugfixes: - Tomcat 9.0.119 * Catalina + Add: Add support for literal '%' characters in access log output. Based on pull request #1002 by Fabian Hahn. (markt) + Fix: Prevent duplicate log messages when clustering JARs are not present on startup. (csutherl) + Code: Remove unnecessary code from the SSI processing engine that was duplicating some of the normalisation checks. (markt) + Fix: Cleaner handling of invalid SPNEGO tokens. (remm) + Fix: Avoid some NPEs in the Connector class on an uninitialize protocol. (remm) + Fix: Incorrect session average life calculation. (remm) + Fix: Improve robustness on using Pipeline.setBasic on a running pipeline. (remm) + Fix: Avoid any init parameter updates when conflicts are found for filters, similar to what is done for servlets, as required by the servlet specification. (remm) + Fix: Fix container event cleanups in some edge cases. (remm) + Fix: Check for last-modified header in ExpiresFilter when a servlet uses addDateHeader to avoid wrongly considering it has been set. (remm) + Fix: Fix hour unit used by ExpiresFilter. (remm) + Fix: Remove exception swallowing in DataSourceStore to align it with FileStore and avoid session loss on errors. (remm) + Fix: Add support for single-quote escaped literal as well as quoted literals in DateFormatCache. (schultz) + Fix: On JAAS logout, clear out role principals on the subject that were added on commit, as recommended by the JAAS specification. (remm) + Fix: MemoryRealm should not add a dummy role when none is specified in the configuration. (remm) + Fix: DataSourceUserDatabase should return a null principal on a non existing user. (remm) + Fix: Fix shared lock expiration in WebDAV. (remm) + Fix: Inaccurate session exipration statistics when using the persistent manager. (remm) + Fix: Skip BOM when serving files with UTF-32 encoding. (remm) + Fix: Mixup of WrapperListener and WrapperLifecycle elements in storeconfig. (remm) + Fix: Incorrect processing of modified users in DataSourceUserDatabase. (remm) + Update: Clarify behavior in the UserDatabase for user, role and group creation that it does not immediately override existing elements. Removal (or update) needs to be used instead. (remm) + Fix: 70049: Align the web application class loader with parent class loaders and swallow any errors caused by invalid paths when looking up resources and behave as if the resources were not found in that case. (markt) + Fix: Improve validation of Range and Content-Range parsers so invalid ranges trigger a 4xx response rather than a 500 response. Pull request #1012 provided by Sahana Surendra Bogar. (markt) + Fix: Fix connection leak in ProxyErrorReportValve. (remm) + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off rather than true or false to align with httpd. (markt) + Fix: Reset the encoding used for query string parameters between requests in case an application changed the encoding in a previous request. (markt) + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce to URLs that are known not to require it. (markt) + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least one sub realm is available. (remm) + Fix: 70048: Correctly handle asynchronous requests in PersistentValve. (markt) + Fix: Improve the detection of cross-context dispatches when using a RequestDispatcher. (markt) + Fix: Fix various instances of double decoding of URL patterns configured either programmatically or in web.xml. (remm/markt) + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite, which follows a purely sequential evaluation strategy. (remm) + Fix: Change the default for the useRedirect attribute of the ProxyErrorReportValve from true to false. (markt) + Add: Add support for the showReport attribute in JsonErrorReportValve and ProxyErrorReportValve. When set to false, detailed error information (message, description, stack trace) is suppressed from error responses. (dsoumis) + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is removed but catalina-ha.jar is present and the Cluster element is enabled in server.xml. Cluster digester rules are now fully conditional on both JARs being available. (dsoumis) + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt) + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list of reserved prefixes for SSI variables and request attributes. (markt) + Fix: Missing URL decoding when processing addMapping on a Servlet registration. (remm) + Fix: The Timeout WebDAV header allows comma separated values (according to the examples in the RFC). Use the first acceptable value. (remm) + Fix: Fix various issues when logging the effective web.xml for a web application. Empty sections are no longer logged. Special roles and empty authorisation constraints are included. (markt) + Fix: Expand the write lock for the save process in the MemoryUserDatabase to avoid concurrency issues with the file save operations. (markt) + Fix: Ensure atomic session persistence in FileStore. Based on pull request #1016 by sahvx655-wq. (markt) + Fix: Do not ignore methods configured on security constraints that map to the default servlet. (markt) * Cluster + Fix: Expand wording and increase visibility of log message when cloud membership is configured without a trust store as all certificates will be trusted in this configuration. (markt) + Fix: Ensure listeners are correctly added and removed when configuring the channel coordinator. (markt) + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt) + Fix: Fix some concurrency issues in OrderInterceptor. (markt) + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt) + Fix: Fix concurrency issues generating MD5 digests in the CloudMembershipProvider implementations. (markt) + Add: Add replay protection to the EncryptInterceptor. This is a breaking change for the EncryptInterceptor. (markt) * Coyote + Add: Log a suitable warning if an encrypted PEM file is detected using an insecure form for encryption. (markt) + Fix: If TLS groups have been configured, use the configured groups rather than using OpenSSL's default TLS groups when using Tomcat Native with OpenSSL based connectors. (markt) + Fix: For HTTP/2, ensure that any in progress request body reads are cancelled if the container resets the associated stream. This prevents delays waiting for reads to time out when it is known that no more data will be received. (markt) + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream reset do so, rather than triggered a connection close. (markt) + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm) + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2, following refactor clean-up of header buffer. (remm) + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm) + Fix: Fix MessageByte.equals if called on a null MB. (remm) + Fix: Call the delegate key manager in JSSE to retrieve the server key. (remm) + Fix: Avoid overflow scenarios in Asn1Parser. (remm) + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that allows the consistency check for the scheme provided by the user agent to be bypassed. (markt) + Fix: isTrailerFieldsReady was always returning true. (remm) + Fix: Align OpenSSL/Panama TLS implementation with other implementations and throw an exception if there is an error loading the provided CRL(s). (markt) + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if @STRENGTH was encountered, ignoring any subsequent expressions. (markt) + Fix: Handle the case where the HTTP/2 payload length is insufficient for the mandatory data required by the flags set in the header. (markt) + Fix: 70102: Correct expected size of ticket keys when calling setSessionTicketKeys with an FFM connector. (markt) + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt) + Fix: When processing an OpenSSL cipher specification, fully align the order of the resulting ciphers with the order produced by OpenSSL. (markt) + Add: Add support for Brainpool TLS groups. Patch provided by YStankov. (schultz) + Update: Update both the minimum and recommended version for Tomcat Native 1.x to 1.3.8. (markt) * Jasper + Fix: Fix possible EL argument mismatch when it was set to null. (remm) + Fix: Fix thread safety of TagPluginManager. (remm) + Fix: Correctly use flush on JSP include. (remm) * Web applications + Add: Manager: Add checks to ensure that any uploaded files are uploaded to the expected location. (markt) + Add: Manager: Add checks to ensure that the requested context path for a deployed WAR, directory or descriptor file is valid. (markt) + Add: Documentation: Expand the description of some of the attributes of the CrawlerSessionManagerValve. (markt) + Fix: Documentation: Clearer description and correct documented default for ocspSoftFail. (markt) + Fix: Fix double escaping in the context names for the JSON mode of the manager servlet. (remm) + Fix: Manager: Ensure automatic deployment does not trigger an undeployment during a Manager triggered web application reload. (markt) + Fix: Documentation: Provide better documentation for the scheme and secure attributes of a Connector. (markt) * Websocket + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm) + Fix: Trigger standard WebSocket error handling if a call to Endpoint.onOpen() fails for a programmatic endpoint. (markt) + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a programmatic endpoint. Test case provided by uabdur. (markt) + Fix: If a client presents invalid parameters when negotiating a WebSocket extension, decline the negotiation offer that includes the invalid parameters rather than failing the connection. Pull request #1019 provided by sahvx655-wq. (markt) * Other + Fix: Wrong references to jakarta instead of javax. (remm) + Fix: Restore default authenticator to nullafter executing an Ant task. (remm) + Update: Update Commons Daemon to 1.6.1. (markt) + Update: Improvements to French translations. (remm) + Update: Improvements to Japanese translations provided by tak7iji. (markt) + Update: Update Tomcat Native to 1.3.8. (markt)CVSSUnscored Insufficient evidenceSUSE-SU-2026:1572-1SUSE Linux Enterprisesuse · tomcat&distro=SUSE Linux Enterprise Server 12 SP5-LTSS +1 more6mo agosuse tomcat&distro=SUSE Linux Enterprise Server 12 SP5-LTSSSecurity update for tomcat This update for tomcat fixes the following issues: Security fixes: - CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850). - CVE-2026-25854: Occasionally open redirect (bsc#1261851). - CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852). - CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853). - CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854). - CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855). - CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856). - CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857). - CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371). Other fixes: - Update to Tomcat 9.0.117CVSSUnscored RoutineCVE-2026-24733apache software foundation · apache tomcat +29 more8mo agoApache Tomcat: Security constraint bypass with HTTP/0.9Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112. Older, EOL versions are also affected. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.CVSS6.5MediumEPSS0.55%