Most recent entries from all

certfr-2026-avi-1358 — De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Certaines d'entre elles permettent à un attaquant d…

2026-10-22T11:36:16.165375+00:00

certfr-2026-avi-1358

fkie_cve-2026-88041

2026-10-22T11:36:16.165440+00:00

Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request.

This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122.

Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

GHSA-f6r2-3pj4-jmqq

2026-10-22T11:36:16.165482+00:00

Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request.

This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122.

Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

RHSA-2026:81365 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

2026-10-22T11:36:16.165503+00:00

tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure tomcat: Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE) tomcat: tomcat: Unauthorized socket access via TOCTOU race condition tomcat: tomcat: Information disclosure via incomplete HTTP trailer cleanup tomcat: Apache Tomcat: Possible TLS 1.3 connection failures tomcat: tomcat: Authentication bypass via non-GSSAPI SASL in JNDI realm tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing tomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes