{"schema_version":"1.7.2","id":"OESA-2026-3592","modified":"2026-09-05T15:02:57Z","published":"2026-09-05T15:02:57Z","upstream":["CVE-2026-65182","CVE-2026-65183","CVE-2026-65637","CVE-2026-65905","CVE-2026-65927","CVE-2026-66422","CVE-2026-68525","CVE-2026-68569","CVE-2026-68763","CVE-2026-73180"],"summary":"tomcat security update","details":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nImproper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.(CVE-2026-65182)\n\nTime-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.(CVE-2026-65183)\n\nImproper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.(CVE-2026-65637)\n\nA vulnerability classified as critical has been found in Apache Tomcat up to 7.0.109/8.5.100/9.0.120/10.1.57/11.0.24 (Application Server Software). Affected is an unknown part of the component DIGEST Authenticator. Upgrading to version 9.0.121, 10.1.58 or 11.0.25 eliminates this vulnerability.(CVE-2026-65905)\n\nOff-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.(CVE-2026-65927)\n\nImproper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.(CVE-2026-66422)\n\nIncorrect Authorization vulnerability in Apache Tomcat_x27;s FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.(CVE-2026-68525)\n\nImproper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.(CVE-2026-68569)\n\nA vulnerability was found in Apache Tomcat up to 11.0.24/10.1.57/9.0.120/8.5.100 (Application Server Software). It has been declared as problematic. This vulnerability affects an unknown code block of the component HTTP2 Backlog Tracking. Upgrading to version 11.0.25, 10.1.58 or 9.0.121 eliminates this vulnerability.(CVE-2026-68763)\n\nA vulnerability was found in Apache Tomcat up to 7.0.109/8.5.100/9.0.120/10.1.57/11.0.24 (Application Server Software). It has been rated as critical. This issue affects some unknown processing of the component Session Expiration. Upgrading to version 9.0.121, 10.1.58 or 11.0.25 eliminates this vulnerability.(CVE-2026-73180)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP4","name":"tomcat","purl":"pkg:rpm/openEuler/tomcat&distro=openEuler-24.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.121-1.oe2403sp4"}]}],"ecosystem_specific":{"noarch":["tomcat-9.0.121-1.oe2403sp4.noarch.rpm","tomcat-help-9.0.121-1.oe2403sp4.noarch.rpm","tomcat-jsvc-9.0.121-1.oe2403sp4.noarch.rpm"],"src":["tomcat-9.0.121-1.oe2403sp4.src.rpm"]}},{"package":{"ecosystem":"openEuler:20.03-LTS-SP4","name":"tomcat","purl":"pkg:rpm/openEuler/tomcat&distro=openEuler-20.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.121-1.oe2003sp4"}]}],"ecosystem_specific":{"noarch":["tomcat-9.0.121-1.oe2003sp4.noarch.rpm","tomcat-help-9.0.121-1.oe2003sp4.noarch.rpm","tomcat-jsvc-9.0.121-1.oe2003sp4.noarch.rpm"],"src":["tomcat-9.0.121-1.oe2003sp4.src.rpm"]}},{"package":{"ecosystem":"openEuler:22.03-LTS-SP4","name":"tomcat","purl":"pkg:rpm/openEuler/tomcat&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.121-1.oe2203sp4"}]}],"ecosystem_specific":{"noarch":["tomcat-9.0.121-1.oe2203sp4.noarch.rpm","tomcat-help-9.0.121-1.oe2203sp4.noarch.rpm","tomcat-jsvc-9.0.121-1.oe2203sp4.noarch.rpm"],"src":["tomcat-9.0.121-1.oe2203sp4.src.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"tomcat","purl":"pkg:rpm/openEuler/tomcat&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.121-1.oe2403sp1"}]}],"ecosystem_specific":{"noarch":["tomcat-9.0.121-1.oe2403sp1.noarch.rpm","tomcat-help-9.0.121-1.oe2403sp1.noarch.rpm","tomcat-jsvc-9.0.121-1.oe2403sp1.noarch.rpm"],"src":["tomcat-9.0.121-1.oe2403sp1.src.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP3","name":"tomcat","purl":"pkg:rpm/openEuler/tomcat&distro=openEuler-24.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.121-1.oe2403sp3"}]}],"ecosystem_specific":{"noarch":["tomcat-9.0.121-1.oe2403sp3.noarch.rpm","tomcat-help-9.0.121-1.oe2403sp3.noarch.rpm","tomcat-jsvc-9.0.121-1.oe2403sp3.noarch.rpm"],"src":["tomcat-9.0.121-1.oe2403sp3.src.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3592"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65182"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65183"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65637"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65905"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65927"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66422"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68525"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68569"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68763"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73180"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"database_specific":{"severity":"Critical"}}