Most recent entries from all

certfr-2026-avi-1358 — De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Certaines d'entre elles permettent à un attaquant d…

2026-10-22T11:34:42.043249+00:00

certfr-2026-avi-1358

fkie_cve-2026-74048

2026-10-22T11:34:42.043295+00:00

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.

Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

GHSA-38jj-69cp-9wgc

2026-10-22T11:34:42.043337+00:00

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.

Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

RHSA-2026:81365 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

2026-10-22T11:34:42.043356+00:00

tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure tomcat: Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE) tomcat: tomcat: Unauthorized socket access via TOCTOU race condition tomcat: tomcat: Information disclosure via incomplete HTTP trailer cleanup tomcat: Apache Tomcat: Possible TLS 1.3 connection failures tomcat: tomcat: Authentication bypass via non-GSSAPI SASL in JNDI realm tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing tomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes