An update for tomcat is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3142 Final 1.0 1.0 2026-07-24 Initial 2026-07-24 2026-07-24 openEuler SA Tool V1.0 2026-07-24 tomcat security update An update for tomcat is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fix(es): Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.(CVE-2026-59083) ['Severity: low\n\nAffected versions:\n\n- Apache Tomcat 11.0.0-M1 through 11.0.23\n- Apache Tomcat 10.1.0-M1 through 10.1.56\n- Apache Tomcat 9.0.13 through 9.0.119\n- Apache Tomcat 8.5.38 through 8.5.100\n- Apache Tomcat 7.0.100 through 7.0.109\n\nDescription:', 'Credit:\n\nNDIx (reporter)\n\nReferences:'](CVE-2026-59084) An update for tomcat is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical tomcat https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3142 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-59083 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-59084 https://nvd.nist.gov/vuln/detail/CVE-2026-59083 https://nvd.nist.gov/vuln/detail/CVE-2026-59084 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 tomcat-9.0.120-1.oe2203sp4.src.rpm tomcat-9.0.120-1.oe2403sp1.src.rpm tomcat-9.0.120-1.oe2403sp3.src.rpm tomcat-9.0.120-1.oe2403sp4.src.rpm tomcat-9.0.120-1.oe2003sp4.src.rpm tomcat-9.0.120-1.oe2203sp4.noarch.rpm tomcat-help-9.0.120-1.oe2203sp4.noarch.rpm tomcat-jsvc-9.0.120-1.oe2203sp4.noarch.rpm tomcat-9.0.120-1.oe2403sp1.noarch.rpm tomcat-help-9.0.120-1.oe2403sp1.noarch.rpm tomcat-jsvc-9.0.120-1.oe2403sp1.noarch.rpm tomcat-9.0.120-1.oe2403sp3.noarch.rpm tomcat-help-9.0.120-1.oe2403sp3.noarch.rpm tomcat-jsvc-9.0.120-1.oe2403sp3.noarch.rpm tomcat-9.0.120-1.oe2403sp4.noarch.rpm tomcat-help-9.0.120-1.oe2403sp4.noarch.rpm tomcat-jsvc-9.0.120-1.oe2403sp4.noarch.rpm tomcat-9.0.120-1.oe2003sp4.noarch.rpm tomcat-help-9.0.120-1.oe2003sp4.noarch.rpm tomcat-jsvc-9.0.120-1.oe2003sp4.noarch.rpm Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue. 2026-07-24 CVE-2026-59083 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N tomcat security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3142 ['Severity: low\n\nAffected versions:\n\n- Apache Tomcat 11.0.0-M1 through 11.0.23\n- Apache Tomcat 10.1.0-M1 through 10.1.56\n- Apache Tomcat 9.0.13 through 9.0.119\n- Apache Tomcat 8.5.38 through 8.5.100\n- Apache Tomcat 7.0.100 through 7.0.109\n\nDescription:', 'Credit:\n\nNDIx (reporter)\n\nReferences:'] 2026-07-24 CVE-2026-59084 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N tomcat security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3142