RHSA-2026:68659
Vulnerability from csaf_opensuse - Published: 2026-09-17 00:00 - Updated: 2026-09-25 16:47Summary
security update for tomcat
Severity
Important
Notes
Title of the patch: security update for tomcat
Description of the patch: This security update provides a functional equivalent of RHSA-2026:68659.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:68659.
Patchnames: RHSA-2026:68659
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
9.8 (Critical)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch | — |
Vendor Fix
|
Threats
Impact
critical
7.5 (High)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
4.8 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
4.8 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
4.8 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
important
4.8 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
7.3 (High)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
important
5.4 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
low
4.2 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
moderate
7.3 (High)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
important
8.2 (High)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
important
7.3 (High)
Affected products
Recommended
8 products, the same list as for
CVE-2024-52316
Threats
Impact
important
References
94 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "security update for tomcat",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This security update provides a functional equivalent of RHSA-2026:68659.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:68659.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "RHSA-2026:68659",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_68659.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-52316 page",
"url": "https://www.suse.com/security/cve/CVE-2024-52316/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-54677 page",
"url": "https://www.suse.com/security/cve/CVE-2024-54677/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-46701 page",
"url": "https://www.suse.com/security/cve/CVE-2025-46701/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-55668 page",
"url": "https://www.suse.com/security/cve/CVE-2025-55668/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-55754 page",
"url": "https://www.suse.com/security/cve/CVE-2025-55754/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-61795 page",
"url": "https://www.suse.com/security/cve/CVE-2025-61795/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-66614 page",
"url": "https://www.suse.com/security/cve/CVE-2025-66614/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-24733 page",
"url": "https://www.suse.com/security/cve/CVE-2026-24733/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-24880 page",
"url": "https://www.suse.com/security/cve/CVE-2026-24880/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25854 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25854/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-29145 page",
"url": "https://www.suse.com/security/cve/CVE-2026-29145/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-32990 page",
"url": "https://www.suse.com/security/cve/CVE-2026-32990/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-34483 page",
"url": "https://www.suse.com/security/cve/CVE-2026-34483/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-34487 page",
"url": "https://www.suse.com/security/cve/CVE-2026-34487/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41284 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41284/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41293 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41293/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42498 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42498/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43512 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43512/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43513 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43513/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43514 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43514/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43515 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43515/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-50229 page",
"url": "https://www.suse.com/security/cve/CVE-2026-50229/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53404 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53404/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53434 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53434/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-55276 page",
"url": "https://www.suse.com/security/cve/CVE-2026-55276/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-55955 page",
"url": "https://www.suse.com/security/cve/CVE-2026-55955/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-55956 page",
"url": "https://www.suse.com/security/cve/CVE-2026-55956/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-55957 page",
"url": "https://www.suse.com/security/cve/CVE-2026-55957/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-59083 page",
"url": "https://www.suse.com/security/cve/CVE-2026-59083/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-59084 page",
"url": "https://www.suse.com/security/cve/CVE-2026-59084/"
}
],
"title": "security update for tomcat",
"tracking": {
"current_release_date": "2026-09-25T16:47:53Z",
"generator": {
"date": "2026-09-17T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "RHSA-2026:68659",
"initial_release_date": "2026-09-17T00:00:00Z",
"revision_history": [
{
"date": "2026-09-17T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-25T16:47:53Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "tomcat-1:9.0.120-1.el9_6.noarch",
"product": {
"name": "tomcat-1:9.0.120-1.el9_6.noarch",
"product_id": "tomcat-1:9.0.120-1.el9_6.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:tomcat:9.0.120:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/tomcat@9.0.120-1.el9_6?arch=noarch\u0026epoch=1\u0026upstream=tomcat-1:9.0.120-1.el9_6.src.rpm"
}
}
},
{
"category": "product_version",
"name": "tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"product": {
"name": "tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"product_id": "tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:tomcat:9.0.120:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/tomcat-admin-webapps@9.0.120-1.el9_6?arch=noarch\u0026epoch=1\u0026upstream=tomcat-1:9.0.120-1.el9_6.src.rpm"
}
}
},
{
"category": "product_version",
"name": "tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"product": {
"name": "tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"product_id": "tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:tomcat:9.0.120:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/tomcat-docs-webapp@9.0.120-1.el9_6?arch=noarch\u0026epoch=1\u0026upstream=tomcat-1:9.0.120-1.el9_6.src.rpm"
}
}
},
{
"category": "product_version",
"name": "tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"product": {
"name": "tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"product_id": "tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/tomcat-el-3.0-api@9.0.120-1.el9_6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"product": {
"name": "tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"product_id": "tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/tomcat-jsp-2.3-api@9.0.120-1.el9_6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-lib-1:9.0.120-1.el9_6.noarch",
"product": {
"name": "tomcat-lib-1:9.0.120-1.el9_6.noarch",
"product_id": "tomcat-lib-1:9.0.120-1.el9_6.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:tomcat:9.0.120:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/tomcat-lib@9.0.120-1.el9_6?arch=noarch\u0026epoch=1\u0026upstream=tomcat-1:9.0.120-1.el9_6.src.rpm"
}
}
},
{
"category": "product_version",
"name": "tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"product": {
"name": "tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"product_id": "tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/tomcat-servlet-4.0-api@9.0.120-1.el9_6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-webapps-1:9.0.120-1.el9_6.noarch",
"product": {
"name": "tomcat-webapps-1:9.0.120-1.el9_6.noarch",
"product_id": "tomcat-webapps-1:9.0.120-1.el9_6.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:tomcat:9.0.120:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/tomcat-webapps@9.0.120-1.el9_6?arch=noarch\u0026epoch=1\u0026upstream=tomcat-1:9.0.120-1.el9_6.src.rpm"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Liberty Linux 9",
"product": {
"name": "SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sll:9"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-1:9.0.120-1.el9_6.noarch as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch"
},
"product_reference": "tomcat-1:9.0.120-1.el9_6.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch"
},
"product_reference": "tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch"
},
"product_reference": "tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch"
},
"product_reference": "tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch"
},
"product_reference": "tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-1:9.0.120-1.el9_6.noarch as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch"
},
"product_reference": "tomcat-lib-1:9.0.120-1.el9_6.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch"
},
"product_reference": "tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-1:9.0.120-1.el9_6.noarch as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
},
"product_reference": "tomcat-webapps-1:9.0.120-1.el9_6.noarch",
"relates_to_product_reference": "SUSE Liberty Linux 9"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-52316",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-52316"
}
],
"notes": [
{
"category": "general",
"text": "Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-52316",
"url": "https://www.suse.com/security/cve/CVE-2024-52316"
},
{
"category": "external",
"summary": "SUSE Bug 1233434 for CVE-2024-52316",
"url": "https://bugzilla.suse.com/1233434"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2024-52316"
},
{
"cve": "CVE-2024-54677",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-54677"
}
],
"notes": [
{
"category": "general",
"text": "Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-54677",
"url": "https://www.suse.com/security/cve/CVE-2024-54677"
},
{
"category": "external",
"summary": "SUSE Bug 1234664 for CVE-2024-54677",
"url": "https://bugzilla.suse.com/1234664"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2024-54677"
},
{
"cve": "CVE-2025-46701",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-46701"
}
],
"notes": [
{
"category": "general",
"text": "Improper Handling of Case Sensitivity vulnerability in Apache Tomcat\u0027s GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-46701",
"url": "https://www.suse.com/security/cve/CVE-2025-46701"
},
{
"category": "external",
"summary": "SUSE Bug 1243815 for CVE-2025-46701",
"url": "https://bugzilla.suse.com/1243815"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-46701"
},
{
"cve": "CVE-2025-55668",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-55668"
}
],
"notes": [
{
"category": "general",
"text": "Session Fixation vulnerability in Apache Tomcat via rewrite valve.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nOlder, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-55668",
"url": "https://www.suse.com/security/cve/CVE-2025-55668"
},
{
"category": "external",
"summary": "SUSE Bug 1248001 for CVE-2025-55668",
"url": "https://bugzilla.suse.com/1248001"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-55668"
},
{
"cve": "CVE-2025-55754",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-55754"
}
],
"notes": [
{
"category": "general",
"text": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.\n\nTomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-55754",
"url": "https://www.suse.com/security/cve/CVE-2025-55754"
},
{
"category": "external",
"summary": "SUSE Bug 1252905 for CVE-2025-55754",
"url": "https://bugzilla.suse.com/1252905"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-55754"
},
{
"cve": "CVE-2025-61795",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-61795"
}
],
"notes": [
{
"category": "general",
"text": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat.\n\nIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-61795",
"url": "https://www.suse.com/security/cve/CVE-2025-61795"
},
{
"category": "external",
"summary": "SUSE Bug 1252756 for CVE-2025-61795",
"url": "https://bugzilla.suse.com/1252756"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-61795"
},
{
"cve": "CVE-2025-66614",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-66614"
}
],
"notes": [
{
"category": "general",
"text": "Improper Input Validation vulnerability.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected.\nTomcat did not validate that the host name provided via the SNI \nextension was the same as the host name provided in the HTTP host header \nfield. If Tomcat was configured with more than one virtual host and the \nTLS configuration for one of those hosts did not require client \ncertificate authentication but another one did, it was possible for a \nclient to bypass the client certificate authentication by sending \ndifferent host names in the SNI extension and the HTTP host header field.\n\n\n\nThe vulnerability only applies if client certificate authentication is \nonly enforced at the Connector. It does not apply if client certificate \nauthentication is enforced at the web application.\n\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-66614",
"url": "https://www.suse.com/security/cve/CVE-2025-66614"
},
{
"category": "external",
"summary": "SUSE Bug 1258371 for CVE-2025-66614",
"url": "https://bugzilla.suse.com/1258371"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2025-66614"
},
{
"cve": "CVE-2026-24733",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-24733"
}
],
"notes": [
{
"category": "general",
"text": "Improper Input Validation vulnerability in Apache Tomcat.\n\n\nTomcat did not limit HTTP/0.9 requests to the GET method. If a security \nconstraint was configured to allow HEAD requests to a URI but deny GET \nrequests, the user could bypass that constraint on GET requests by \nsending a (specification invalid) HEAD request using HTTP/0.9.\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.\n\n\nOlder, EOL versions are also affected.\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-24733",
"url": "https://www.suse.com/security/cve/CVE-2026-24733"
},
{
"category": "external",
"summary": "SUSE Bug 1258385 for CVE-2026-24733",
"url": "https://bugzilla.suse.com/1258385"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-24733"
},
{
"cve": "CVE-2026-24880",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-24880"
}
],
"notes": [
{
"category": "general",
"text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in Apache Tomcat via invalid chunk extension.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOther, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-24880",
"url": "https://www.suse.com/security/cve/CVE-2026-24880"
},
{
"category": "external",
"summary": "SUSE Bug 1261850 for CVE-2026-24880",
"url": "https://bugzilla.suse.com/1261850"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-24880"
},
{
"cve": "CVE-2026-25854",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25854"
}
],
"notes": [
{
"category": "general",
"text": "Occasional URL redirection to untrusted Site (\u0027Open Redirect\u0027) vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.\nOther, unsupported versions may also be affected\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25854",
"url": "https://www.suse.com/security/cve/CVE-2026-25854"
},
{
"category": "external",
"summary": "SUSE Bug 1261851 for CVE-2026-25854",
"url": "https://bugzilla.suse.com/1261851"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-25854"
},
{
"cve": "CVE-2026-29145",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-29145"
}
],
"notes": [
{
"category": "general",
"text": "CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.\n\nUsers are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-29145",
"url": "https://www.suse.com/security/cve/CVE-2026-29145"
},
{
"category": "external",
"summary": "SUSE Bug 1261853 for CVE-2026-29145",
"url": "https://bugzilla.suse.com/1261853"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-29145"
},
{
"cve": "CVE-2026-32990",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-32990"
}
],
"notes": [
{
"category": "general",
"text": "Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.\n\nThis issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-32990",
"url": "https://www.suse.com/security/cve/CVE-2026-32990"
},
{
"category": "external",
"summary": "SUSE Bug 1258371 for CVE-2026-32990",
"url": "https://bugzilla.suse.com/1258371"
},
{
"category": "external",
"summary": "SUSE Bug 1276895 for CVE-2026-32990",
"url": "https://bugzilla.suse.com/1276895"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-32990"
},
{
"cve": "CVE-2026-34483",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-34483"
}
],
"notes": [
{
"category": "general",
"text": "Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-34483",
"url": "https://www.suse.com/security/cve/CVE-2026-34483"
},
{
"category": "external",
"summary": "SUSE Bug 1261855 for CVE-2026-34483",
"url": "https://bugzilla.suse.com/1261855"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-34483"
},
{
"cve": "CVE-2026-34487",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-34487"
}
],
"notes": [
{
"category": "general",
"text": "Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-34487",
"url": "https://www.suse.com/security/cve/CVE-2026-34487"
},
{
"category": "external",
"summary": "SUSE Bug 1261856 for CVE-2026-34487",
"url": "https://bugzilla.suse.com/1261856"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-34487"
},
{
"cve": "CVE-2026-41284",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41284"
}
],
"notes": [
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.\nOlder, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41284",
"url": "https://www.suse.com/security/cve/CVE-2026-41284"
},
{
"category": "external",
"summary": "SUSE Bug 1265162 for CVE-2026-41284",
"url": "https://bugzilla.suse.com/1265162"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-41284"
},
{
"cve": "CVE-2026-41293",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41293"
}
],
"notes": [
{
"category": "general",
"text": "Improper Input Validation vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.\nOlder, end of support versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41293",
"url": "https://www.suse.com/security/cve/CVE-2026-41293"
},
{
"category": "external",
"summary": "SUSE Bug 1265163 for CVE-2026-41293",
"url": "https://bugzilla.suse.com/1265163"
},
{
"category": "external",
"summary": "SUSE Bug 1282787 for CVE-2026-41293",
"url": "https://bugzilla.suse.com/1282787"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-41293"
},
{
"cve": "CVE-2026-42498",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42498"
}
],
"notes": [
{
"category": "general",
"text": "Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42498",
"url": "https://www.suse.com/security/cve/CVE-2026-42498"
},
{
"category": "external",
"summary": "SUSE Bug 1265165 for CVE-2026-42498",
"url": "https://bugzilla.suse.com/1265165"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-42498"
},
{
"cve": "CVE-2026-43512",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43512"
}
],
"notes": [
{
"category": "general",
"text": "DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.\nOlder unsupported versions any also be affect\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43512",
"url": "https://www.suse.com/security/cve/CVE-2026-43512"
},
{
"category": "external",
"summary": "SUSE Bug 1265145 for CVE-2026-43512",
"url": "https://bugzilla.suse.com/1265145"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-43512"
},
{
"cve": "CVE-2026-43513",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43513"
}
],
"notes": [
{
"category": "general",
"text": "Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43513",
"url": "https://www.suse.com/security/cve/CVE-2026-43513"
},
{
"category": "external",
"summary": "SUSE Bug 1265166 for CVE-2026-43513",
"url": "https://bugzilla.suse.com/1265166"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-43513"
},
{
"cve": "CVE-2026-43514",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43514"
}
],
"notes": [
{
"category": "general",
"text": "Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43514",
"url": "https://www.suse.com/security/cve/CVE-2026-43514"
},
{
"category": "external",
"summary": "SUSE Bug 1265167 for CVE-2026-43514",
"url": "https://bugzilla.suse.com/1265167"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-43514"
},
{
"cve": "CVE-2026-43515",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43515"
}
],
"notes": [
{
"category": "general",
"text": "Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43515",
"url": "https://www.suse.com/security/cve/CVE-2026-43515"
},
{
"category": "external",
"summary": "SUSE Bug 1265168 for CVE-2026-43515",
"url": "https://bugzilla.suse.com/1265168"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-43515"
},
{
"cve": "CVE-2026-50229",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-50229"
}
],
"notes": [
{
"category": "general",
"text": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-50229",
"url": "https://www.suse.com/security/cve/CVE-2026-50229"
},
{
"category": "external",
"summary": "SUSE Bug 1269791 for CVE-2026-50229",
"url": "https://bugzilla.suse.com/1269791"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-50229"
},
{
"cve": "CVE-2026-53404",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53404"
}
],
"notes": [
{
"category": "general",
"text": "Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat\u0027s rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53404",
"url": "https://www.suse.com/security/cve/CVE-2026-53404"
},
{
"category": "external",
"summary": "SUSE Bug 1269910 for CVE-2026-53404",
"url": "https://bugzilla.suse.com/1269910"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-53404"
},
{
"cve": "CVE-2026-53434",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53434"
}
],
"notes": [
{
"category": "general",
"text": "Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53434",
"url": "https://www.suse.com/security/cve/CVE-2026-53434"
},
{
"category": "external",
"summary": "SUSE Bug 1269824 for CVE-2026-53434",
"url": "https://bugzilla.suse.com/1269824"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-53434"
},
{
"cve": "CVE-2026-55276",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-55276"
}
],
"notes": [
{
"category": "general",
"text": "Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-55276",
"url": "https://www.suse.com/security/cve/CVE-2026-55276"
},
{
"category": "external",
"summary": "SUSE Bug 1269909 for CVE-2026-55276",
"url": "https://bugzilla.suse.com/1269909"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2026-55276"
},
{
"cve": "CVE-2026-55955",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-55955"
}
],
"notes": [
{
"category": "general",
"text": "Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-55955",
"url": "https://www.suse.com/security/cve/CVE-2026-55955"
},
{
"category": "external",
"summary": "SUSE Bug 1269908 for CVE-2026-55955",
"url": "https://bugzilla.suse.com/1269908"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-55955"
},
{
"cve": "CVE-2026-55956",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-55956"
}
],
"notes": [
{
"category": "general",
"text": "Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-55956",
"url": "https://www.suse.com/security/cve/CVE-2026-55956"
},
{
"category": "external",
"summary": "SUSE Bug 1269907 for CVE-2026-55956",
"url": "https://bugzilla.suse.com/1269907"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-55956"
},
{
"cve": "CVE-2026-55957",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-55957"
}
],
"notes": [
{
"category": "general",
"text": "Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-55957",
"url": "https://www.suse.com/security/cve/CVE-2026-55957"
},
{
"category": "external",
"summary": "SUSE Bug 1269906 for CVE-2026-55957",
"url": "https://bugzilla.suse.com/1269906"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-55957"
},
{
"cve": "CVE-2026-59083",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-59083"
}
],
"notes": [
{
"category": "general",
"text": "Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat\u0027s rewrite valve allowed security constraint bypass for some configurations.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-59083",
"url": "https://www.suse.com/security/cve/CVE-2026-59083"
},
{
"category": "external",
"summary": "SUSE Bug 1271397 for CVE-2026-59083",
"url": "https://bugzilla.suse.com/1271397"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-59083"
},
{
"cve": "CVE-2026-59084",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-59084"
}
],
"notes": [
{
"category": "general",
"text": "Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-59084",
"url": "https://www.suse.com/security/cve/CVE-2026-59084"
},
{
"category": "external",
"summary": "SUSE Bug 1271398 for CVE-2026-59084",
"url": "https://bugzilla.suse.com/1271398"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:tomcat-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-admin-webapps-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-docs-webapp-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-el-3.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-jsp-2.3-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-lib-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-servlet-4.0-api-1:9.0.120-1.el9_6.noarch",
"SUSE Liberty Linux 9:tomcat-webapps-1:9.0.120-1.el9_6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-59084"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…