{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "tomcat-9.0.121-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the tomcat-9.0.121-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11759",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11759-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-65182 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-65182/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-65183 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-65183/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-65637 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-65637/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-65905 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-65905/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-65927 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-65927/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-66299 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-66299/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-66422 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-66422/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-68525 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-68525/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-68569 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-68569/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-68763 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-68763/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-73180 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-73180/"
      }
    ],
    "title": "tomcat-9.0.121-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-09-11T00:00:00Z",
      "generator": {
        "date": "2026-09-11T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11759-1",
      "initial_release_date": "2026-09-11T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-09-11T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-9.0.121-1.1.aarch64",
                "product": {
                  "name": "tomcat-9.0.121-1.1.aarch64",
                  "product_id": "tomcat-9.0.121-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-9.0.121-1.1.aarch64",
                "product": {
                  "name": "tomcat-admin-webapps-9.0.121-1.1.aarch64",
                  "product_id": "tomcat-admin-webapps-9.0.121-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-9.0.121-1.1.aarch64",
                "product": {
                  "name": "tomcat-docs-webapp-9.0.121-1.1.aarch64",
                  "product_id": "tomcat-docs-webapp-9.0.121-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-3_0-api-9.0.121-1.1.aarch64",
                "product": {
                  "name": "tomcat-el-3_0-api-9.0.121-1.1.aarch64",
                  "product_id": "tomcat-el-3_0-api-9.0.121-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-embed-9.0.121-1.1.aarch64",
                "product": {
                  "name": "tomcat-embed-9.0.121-1.1.aarch64",
                  "product_id": "tomcat-embed-9.0.121-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-javadoc-9.0.121-1.1.aarch64",
                "product": {
                  "name": "tomcat-javadoc-9.0.121-1.1.aarch64",
                  "product_id": "tomcat-javadoc-9.0.121-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
                "product": {
                  "name": "tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
                  "product_id": "tomcat-jsp-2_3-api-9.0.121-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsvc-9.0.121-1.1.aarch64",
                "product": {
                  "name": "tomcat-jsvc-9.0.121-1.1.aarch64",
                  "product_id": "tomcat-jsvc-9.0.121-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-9.0.121-1.1.aarch64",
                "product": {
                  "name": "tomcat-lib-9.0.121-1.1.aarch64",
                  "product_id": "tomcat-lib-9.0.121-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
                "product": {
                  "name": "tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
                  "product_id": "tomcat-servlet-4_0-api-9.0.121-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-9.0.121-1.1.aarch64",
                "product": {
                  "name": "tomcat-webapps-9.0.121-1.1.aarch64",
                  "product_id": "tomcat-webapps-9.0.121-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-9.0.121-1.1.ppc64le",
                "product": {
                  "name": "tomcat-9.0.121-1.1.ppc64le",
                  "product_id": "tomcat-9.0.121-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-9.0.121-1.1.ppc64le",
                "product": {
                  "name": "tomcat-admin-webapps-9.0.121-1.1.ppc64le",
                  "product_id": "tomcat-admin-webapps-9.0.121-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-9.0.121-1.1.ppc64le",
                "product": {
                  "name": "tomcat-docs-webapp-9.0.121-1.1.ppc64le",
                  "product_id": "tomcat-docs-webapp-9.0.121-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
                "product": {
                  "name": "tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
                  "product_id": "tomcat-el-3_0-api-9.0.121-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-embed-9.0.121-1.1.ppc64le",
                "product": {
                  "name": "tomcat-embed-9.0.121-1.1.ppc64le",
                  "product_id": "tomcat-embed-9.0.121-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-javadoc-9.0.121-1.1.ppc64le",
                "product": {
                  "name": "tomcat-javadoc-9.0.121-1.1.ppc64le",
                  "product_id": "tomcat-javadoc-9.0.121-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
                "product": {
                  "name": "tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
                  "product_id": "tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsvc-9.0.121-1.1.ppc64le",
                "product": {
                  "name": "tomcat-jsvc-9.0.121-1.1.ppc64le",
                  "product_id": "tomcat-jsvc-9.0.121-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-9.0.121-1.1.ppc64le",
                "product": {
                  "name": "tomcat-lib-9.0.121-1.1.ppc64le",
                  "product_id": "tomcat-lib-9.0.121-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
                "product": {
                  "name": "tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
                  "product_id": "tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-9.0.121-1.1.ppc64le",
                "product": {
                  "name": "tomcat-webapps-9.0.121-1.1.ppc64le",
                  "product_id": "tomcat-webapps-9.0.121-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-9.0.121-1.1.s390x",
                "product": {
                  "name": "tomcat-9.0.121-1.1.s390x",
                  "product_id": "tomcat-9.0.121-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-9.0.121-1.1.s390x",
                "product": {
                  "name": "tomcat-admin-webapps-9.0.121-1.1.s390x",
                  "product_id": "tomcat-admin-webapps-9.0.121-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-9.0.121-1.1.s390x",
                "product": {
                  "name": "tomcat-docs-webapp-9.0.121-1.1.s390x",
                  "product_id": "tomcat-docs-webapp-9.0.121-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-3_0-api-9.0.121-1.1.s390x",
                "product": {
                  "name": "tomcat-el-3_0-api-9.0.121-1.1.s390x",
                  "product_id": "tomcat-el-3_0-api-9.0.121-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-embed-9.0.121-1.1.s390x",
                "product": {
                  "name": "tomcat-embed-9.0.121-1.1.s390x",
                  "product_id": "tomcat-embed-9.0.121-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-javadoc-9.0.121-1.1.s390x",
                "product": {
                  "name": "tomcat-javadoc-9.0.121-1.1.s390x",
                  "product_id": "tomcat-javadoc-9.0.121-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
                "product": {
                  "name": "tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
                  "product_id": "tomcat-jsp-2_3-api-9.0.121-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsvc-9.0.121-1.1.s390x",
                "product": {
                  "name": "tomcat-jsvc-9.0.121-1.1.s390x",
                  "product_id": "tomcat-jsvc-9.0.121-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-9.0.121-1.1.s390x",
                "product": {
                  "name": "tomcat-lib-9.0.121-1.1.s390x",
                  "product_id": "tomcat-lib-9.0.121-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
                "product": {
                  "name": "tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
                  "product_id": "tomcat-servlet-4_0-api-9.0.121-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-9.0.121-1.1.s390x",
                "product": {
                  "name": "tomcat-webapps-9.0.121-1.1.s390x",
                  "product_id": "tomcat-webapps-9.0.121-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-9.0.121-1.1.x86_64",
                "product": {
                  "name": "tomcat-9.0.121-1.1.x86_64",
                  "product_id": "tomcat-9.0.121-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-9.0.121-1.1.x86_64",
                "product": {
                  "name": "tomcat-admin-webapps-9.0.121-1.1.x86_64",
                  "product_id": "tomcat-admin-webapps-9.0.121-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-9.0.121-1.1.x86_64",
                "product": {
                  "name": "tomcat-docs-webapp-9.0.121-1.1.x86_64",
                  "product_id": "tomcat-docs-webapp-9.0.121-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-3_0-api-9.0.121-1.1.x86_64",
                "product": {
                  "name": "tomcat-el-3_0-api-9.0.121-1.1.x86_64",
                  "product_id": "tomcat-el-3_0-api-9.0.121-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-embed-9.0.121-1.1.x86_64",
                "product": {
                  "name": "tomcat-embed-9.0.121-1.1.x86_64",
                  "product_id": "tomcat-embed-9.0.121-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-javadoc-9.0.121-1.1.x86_64",
                "product": {
                  "name": "tomcat-javadoc-9.0.121-1.1.x86_64",
                  "product_id": "tomcat-javadoc-9.0.121-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
                "product": {
                  "name": "tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
                  "product_id": "tomcat-jsp-2_3-api-9.0.121-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsvc-9.0.121-1.1.x86_64",
                "product": {
                  "name": "tomcat-jsvc-9.0.121-1.1.x86_64",
                  "product_id": "tomcat-jsvc-9.0.121-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-9.0.121-1.1.x86_64",
                "product": {
                  "name": "tomcat-lib-9.0.121-1.1.x86_64",
                  "product_id": "tomcat-lib-9.0.121-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
                "product": {
                  "name": "tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
                  "product_id": "tomcat-servlet-4_0-api-9.0.121-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-9.0.121-1.1.x86_64",
                "product": {
                  "name": "tomcat-webapps-9.0.121-1.1.x86_64",
                  "product_id": "tomcat-webapps-9.0.121-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.121-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64"
        },
        "product_reference": "tomcat-9.0.121-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.121-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le"
        },
        "product_reference": "tomcat-9.0.121-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.121-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x"
        },
        "product_reference": "tomcat-9.0.121-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.121-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64"
        },
        "product_reference": "tomcat-9.0.121-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.121-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64"
        },
        "product_reference": "tomcat-admin-webapps-9.0.121-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.121-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le"
        },
        "product_reference": "tomcat-admin-webapps-9.0.121-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.121-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x"
        },
        "product_reference": "tomcat-admin-webapps-9.0.121-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.121-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64"
        },
        "product_reference": "tomcat-admin-webapps-9.0.121-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-9.0.121-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64"
        },
        "product_reference": "tomcat-docs-webapp-9.0.121-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-9.0.121-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le"
        },
        "product_reference": "tomcat-docs-webapp-9.0.121-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-9.0.121-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x"
        },
        "product_reference": "tomcat-docs-webapp-9.0.121-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-9.0.121-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64"
        },
        "product_reference": "tomcat-docs-webapp-9.0.121-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.121-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.121-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.121-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.121-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.121-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.121-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.121-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-embed-9.0.121-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64"
        },
        "product_reference": "tomcat-embed-9.0.121-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-embed-9.0.121-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le"
        },
        "product_reference": "tomcat-embed-9.0.121-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-embed-9.0.121-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x"
        },
        "product_reference": "tomcat-embed-9.0.121-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-embed-9.0.121-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64"
        },
        "product_reference": "tomcat-embed-9.0.121-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-9.0.121-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64"
        },
        "product_reference": "tomcat-javadoc-9.0.121-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-9.0.121-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le"
        },
        "product_reference": "tomcat-javadoc-9.0.121-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-9.0.121-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x"
        },
        "product_reference": "tomcat-javadoc-9.0.121-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-9.0.121-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64"
        },
        "product_reference": "tomcat-javadoc-9.0.121-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.121-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.121-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.121-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsvc-9.0.121-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64"
        },
        "product_reference": "tomcat-jsvc-9.0.121-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsvc-9.0.121-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le"
        },
        "product_reference": "tomcat-jsvc-9.0.121-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsvc-9.0.121-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x"
        },
        "product_reference": "tomcat-jsvc-9.0.121-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsvc-9.0.121-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64"
        },
        "product_reference": "tomcat-jsvc-9.0.121-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.121-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64"
        },
        "product_reference": "tomcat-lib-9.0.121-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.121-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le"
        },
        "product_reference": "tomcat-lib-9.0.121-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.121-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x"
        },
        "product_reference": "tomcat-lib-9.0.121-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.121-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64"
        },
        "product_reference": "tomcat-lib-9.0.121-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.121-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.121-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.121-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.121-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64"
        },
        "product_reference": "tomcat-webapps-9.0.121-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.121-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le"
        },
        "product_reference": "tomcat-webapps-9.0.121-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.121-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x"
        },
        "product_reference": "tomcat-webapps-9.0.121-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.121-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
        },
        "product_reference": "tomcat-webapps-9.0.121-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-65182",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-65182"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-65182",
          "url": "https://www.suse.com/security/cve/CVE-2026-65182"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276893 for CVE-2026-65182",
          "url": "https://bugzilla.suse.com/1276893"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-11T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-65182"
    },
    {
      "cve": "CVE-2026-65183",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-65183"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-65183",
          "url": "https://www.suse.com/security/cve/CVE-2026-65183"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276894 for CVE-2026-65183",
          "url": "https://bugzilla.suse.com/1276894"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-65183"
    },
    {
      "cve": "CVE-2026-65637",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-65637"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-65637",
          "url": "https://www.suse.com/security/cve/CVE-2026-65637"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276895 for CVE-2026-65637",
          "url": "https://bugzilla.suse.com/1276895"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-11T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-65637"
    },
    {
      "cve": "CVE-2026-65905",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-65905"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authentication Bypass by Capture-replay vulnerability in Apache Tomcat\u0027s DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST \nauthenticated request with a nonceCount on the upper boundary of the \nreplay window then that request is replayable once only while the \nassociated nonceCount remains within the replay window.\n\n\n\n  \n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected:  from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-65905",
          "url": "https://www.suse.com/security/cve/CVE-2026-65905"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276896 for CVE-2026-65905",
          "url": "https://bugzilla.suse.com/1276896"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-65905"
    },
    {
      "cve": "CVE-2026-65927",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-65927"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-65927",
          "url": "https://www.suse.com/security/cve/CVE-2026-65927"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276897 for CVE-2026-65927",
          "url": "https://bugzilla.suse.com/1276897"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-11T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-65927"
    },
    {
      "cve": "CVE-2026-66299",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-66299"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat\u0027s WebSocket chat example.\n\nThis issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.\n\nUsers are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-66299",
          "url": "https://www.suse.com/security/cve/CVE-2026-66299"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1273150 for CVE-2026-66299",
          "url": "https://bugzilla.suse.com/1273150"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-11T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-66299"
    },
    {
      "cve": "CVE-2026-66422",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-66422"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-66422",
          "url": "https://www.suse.com/security/cve/CVE-2026-66422"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276898 for CVE-2026-66422",
          "url": "https://bugzilla.suse.com/1276898"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-66422"
    },
    {
      "cve": "CVE-2026-68525",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-68525"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Incorrect Authorization vulnerability in Apache Tomcat\u0027s FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-68525",
          "url": "https://www.suse.com/security/cve/CVE-2026-68525"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276899 for CVE-2026-68525",
          "url": "https://bugzilla.suse.com/1276899"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-68525"
    },
    {
      "cve": "CVE-2026-68569",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-68569"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-68569",
          "url": "https://www.suse.com/security/cve/CVE-2026-68569"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276900 for CVE-2026-68569",
          "url": "https://bugzilla.suse.com/1276900"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-68569"
    },
    {
      "cve": "CVE-2026-68763",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-68763"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat  via an allocation leak in the HTTP/2 backlog tracking when a stream is reset\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.59 through 8.5.100.  Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-68763",
          "url": "https://www.suse.com/security/cve/CVE-2026-68763"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276901 for CVE-2026-68763",
          "url": "https://bugzilla.suse.com/1276901"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-11T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-68763"
    },
    {
      "cve": "CVE-2026-73180",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-73180"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109.  Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
          "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-73180",
          "url": "https://www.suse.com/security/cve/CVE-2026-73180"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276902 for CVE-2026-73180",
          "url": "https://bugzilla.suse.com/1276902"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-embed-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-javadoc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-jsvc-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-lib-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.121-1.1.x86_64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.aarch64",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.ppc64le",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.s390x",
            "openSUSE Tumbleweed:tomcat-webapps-9.0.121-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-11T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-73180"
    }
  ]
}