An update for tomcat is now available for openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3592 Final 1.0 1.0 2026-09-05 Initial 2026-09-05 2026-09-05 openEuler SA Tool V1.0 2026-09-05 tomcat security update An update for tomcat is now available for openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fix(es): Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.(CVE-2026-65182) Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.(CVE-2026-65183) Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.(CVE-2026-65637) A vulnerability classified as critical has been found in Apache Tomcat up to 7.0.109/8.5.100/9.0.120/10.1.57/11.0.24 (Application Server Software). Affected is an unknown part of the component DIGEST Authenticator. Upgrading to version 9.0.121, 10.1.58 or 11.0.25 eliminates this vulnerability.(CVE-2026-65905) Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.(CVE-2026-65927) Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.(CVE-2026-66422) Incorrect Authorization vulnerability in Apache Tomcat_x27;s FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.(CVE-2026-68525) Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.(CVE-2026-68569) A vulnerability was found in Apache Tomcat up to 11.0.24/10.1.57/9.0.120/8.5.100 (Application Server Software). It has been declared as problematic. This vulnerability affects an unknown code block of the component HTTP2 Backlog Tracking. Upgrading to version 11.0.25, 10.1.58 or 9.0.121 eliminates this vulnerability.(CVE-2026-68763) A vulnerability was found in Apache Tomcat up to 7.0.109/8.5.100/9.0.120/10.1.57/11.0.24 (Application Server Software). It has been rated as critical. This issue affects some unknown processing of the component Session Expiration. Upgrading to version 9.0.121, 10.1.58 or 11.0.25 eliminates this vulnerability.(CVE-2026-73180) An update for tomcat is now available for openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical tomcat https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3592 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-65182 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-65183 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-65637 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-65905 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-65927 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-66422 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-68525 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-68569 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-68763 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-73180 https://nvd.nist.gov/vuln/detail/CVE-2026-65182 https://nvd.nist.gov/vuln/detail/CVE-2026-65183 https://nvd.nist.gov/vuln/detail/CVE-2026-65637 https://nvd.nist.gov/vuln/detail/CVE-2026-65905 https://nvd.nist.gov/vuln/detail/CVE-2026-65927 https://nvd.nist.gov/vuln/detail/CVE-2026-66422 https://nvd.nist.gov/vuln/detail/CVE-2026-68525 https://nvd.nist.gov/vuln/detail/CVE-2026-68569 https://nvd.nist.gov/vuln/detail/CVE-2026-68763 https://nvd.nist.gov/vuln/detail/CVE-2026-73180 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 tomcat-9.0.121-1.oe2403sp4.src.rpm tomcat-9.0.121-1.oe2003sp4.src.rpm tomcat-9.0.121-1.oe2203sp4.src.rpm tomcat-9.0.121-1.oe2403sp1.src.rpm tomcat-9.0.121-1.oe2403sp3.src.rpm tomcat-9.0.121-1.oe2403sp4.noarch.rpm tomcat-help-9.0.121-1.oe2403sp4.noarch.rpm tomcat-jsvc-9.0.121-1.oe2403sp4.noarch.rpm tomcat-9.0.121-1.oe2003sp4.noarch.rpm tomcat-help-9.0.121-1.oe2003sp4.noarch.rpm tomcat-jsvc-9.0.121-1.oe2003sp4.noarch.rpm tomcat-9.0.121-1.oe2203sp4.noarch.rpm tomcat-help-9.0.121-1.oe2203sp4.noarch.rpm tomcat-jsvc-9.0.121-1.oe2203sp4.noarch.rpm tomcat-9.0.121-1.oe2403sp1.noarch.rpm tomcat-help-9.0.121-1.oe2403sp1.noarch.rpm tomcat-jsvc-9.0.121-1.oe2403sp1.noarch.rpm tomcat-9.0.121-1.oe2403sp3.noarch.rpm tomcat-help-9.0.121-1.oe2403sp3.noarch.rpm tomcat-jsvc-9.0.121-1.oe2403sp3.noarch.rpm Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. 2026-09-05 CVE-2026-65182 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N tomcat security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3592 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. 2026-09-05 CVE-2026-65183 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 Medium 6.3 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N tomcat security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3592 Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue. 2026-09-05 CVE-2026-65637 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H tomcat security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3592 A vulnerability classified as critical has been found in Apache Tomcat up to 7.0.109/8.5.100/9.0.120/10.1.57/11.0.24 (Application Server Software). Affected is an unknown part of the component DIGEST Authenticator. Upgrading to version 9.0.121, 10.1.58 or 11.0.25 eliminates this vulnerability. 2026-09-05 CVE-2026-65905 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H tomcat security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3592 Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue. 2026-09-05 CVE-2026-65927 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H tomcat security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3592 Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue. 2026-09-05 CVE-2026-66422 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H tomcat security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3592 Incorrect Authorization vulnerability in Apache Tomcat_x27;s FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue. 2026-09-05 CVE-2026-68525 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 Critical 9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N tomcat security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3592 Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue. 2026-09-05 CVE-2026-68569 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 High 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H tomcat security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3592 A vulnerability was found in Apache Tomcat up to 11.0.24/10.1.57/9.0.120/8.5.100 (Application Server Software). It has been declared as problematic. This vulnerability affects an unknown code block of the component HTTP2 Backlog Tracking. Upgrading to version 11.0.25, 10.1.58 or 9.0.121 eliminates this vulnerability. 2026-09-05 CVE-2026-68763 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H tomcat security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3592 A vulnerability was found in Apache Tomcat up to 7.0.109/8.5.100/9.0.120/10.1.57/11.0.24 (Application Server Software). It has been rated as critical. This issue affects some unknown processing of the component Session Expiration. Upgrading to version 9.0.121, 10.1.58 or 11.0.25 eliminates this vulnerability. 2026-09-05 CVE-2026-73180 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 High 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H tomcat security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3592