OPENSUSE-SU-2026:21984-1

Vulnerability from csaf_opensuse - Published: 2026-09-30 17:58 - Updated: 2026-10-01 16:39
Summary
Security update for libtcnative-1-0, libtcnative-2-0, tomcat, tomcat10, tomcat11
Severity
Critical
Notes
Title of the patch: Security update for libtcnative-1-0, libtcnative-2-0, tomcat, tomcat10, tomcat11
Description of the patch: This update for libtcnative-1-0, libtcnative-2-0, tomcat, tomcat10, tomcat11 fixes the following issues: Security issues fixed: - CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore (bsc#1282631). - CVE-2026-75973: improper authentication when Jakarta authentication is configured with `SimpleAuthConfigProvider` (bsc#1282630). - CVE-2026-76183: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629). - CVE-2026-77756: inconsistent interpretation of HTTP requests allows an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy (bsc#1282628). - CVE-2026-77762: Apache Tomcat: Stale HPACK emitter injects trailers (bsc#1282599). - CVE-2026-77791: uncontrolled resource consumption when sending WebSocket close message enabled a DoS attack (bsc#1282627). - CVE-2026-78383: allocation of resources without limits or throttling allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service (bsc#1282626). - CVE-2026-78437: incomplete cleanup allows a malformed request to potentially cause requests from another user to fail (bsc#1282625). - CVE-2026-79677: missing release of resource after effective lifetime and comparison using wrong factors allows for denial of service due to lost time outs for asynchronous WebSocket writes (bsc#1282624). - CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash (bsc#1282623). - CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622). - CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for some configurations (bsc#1282621). - CVE-2026-86248: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled (bsc#1282620). - CVE-2026-86350: HTTP/2 requests can cause request header mix-ups and HTTP request smuggling (bsc#1282787). - CVE-2026-87022: Apache Tomcat: WebSocket message smuggling with (bsc#1282581). Non security issue fixed: - package libtcnative-1-0-devel houses link to libtcnative-1.so instead of package libtcnative-1-0 (bsc#622430). Changes for libtcnative-1-0: - Update to 1.3.9 + Code: Remove call to ERR_remove_thread_state() from Windows specific code to allow building with OpenSSL 4.0.x. ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got removed in OpenSSL 4 + Fix: Fix a potential crash when negotiating ALPN + If ALPN negotiation fails and failure is configured to use the last server protocol in the list, use it rather than the last protocol offered by the client + Fix: Add support for the extended range of options available from OpenSSL 3.0.x. The options flag is now a 64-bit unsigned int (represented by a Java long) rather than a 32-bit unsigned int (represented by a Java int) + Code: Remove unused code + Ensure that per connection changes to certificate verification settings, e.g. to support client certificate authentication, do not modify the certificate verification settings for other connections + Fix: Fix a potential crash when configuring raw certificates + Fix: Avoid a potential crash with very long ALPN protocol names + Fix: Make the call to a CertificateVerifier more robust + Fix: Avoid a potential crash when processing OCSP URLs + Fix: Make the processing of OCSP responses more robust + Fix: Stricter OCSP handling when soft-fail is disabled + Fix: Harden against the mis-use of Buffer.address(ByteBuffer) + Fix: Harden against the mis-use of Pool.destroy(long) + Code: The minimum supported OpenSSL version is now 3.0.x. OpenSSL 1.1.1 support was accidentally broken in 1.3.8. As no bug reports were receive for that failure and since both Debian and Ubuntu versions that used OpenSSL 1.1.1 have reached end of support, OpenSSL 1.1.1 is no longer supported + Update: OpenSSL 3.0.x is approaching end of support so the recommended version of OpenSSL (and the version that windows binaries will be built with) now follows the 3.5.x LTS branch + Fix: Switch to automatic configuration of DH parameters. Manual configuration attempts will be ignored + Code: Make setTmpECDHByCurveName() a NO-OP + Fix: Refactor extraction of ECDH curve name from the Certificate to avoid deprecated OpenSSL methods + Fix: Refactor the native implementation of SSL.getTime() to avoid the Y2038 problem in SSL_SESSION_get_time() when running on a verion of OpenSSL that includes the new SSL_SESSION_get_time_ex() method Changes for libtcnative-2-0: - Upgrade to version 2.0.16 + Code: Remove call to ERR_remove_thread_state() from Windows specific code to allow building with OpenSSL 4.0.x ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got removed in OpenSSL 4 + Update: Remove support for Windows build on IA64 architecture (Itanium) + Update: Make x64 the default architecture for Windows build + Update: Make Windows 10 / 11 the default target version for Windows builds + Fix: Fix a potential crash when negotiating ALPN + Fix: If ALPN negotiation fails and failure is configured to use the last server protocol in the list, use it rather than the last protocol offered by the client + Fix: Add support for the extended range of options available from OpenSSL 3.0.x. The options flag is now a 64-bit unsigned int (represented by a Java long) rather than a 32-bit unsigned int (represented by a Java int) + Code: Remove unused code + Fix: Ensure that per connection changes to certificate verification settings, e.g. to support client certificate authentication, do not modify the certificate verification settings for other connections + Fix: Fix a potential crash when configuring raw certificates + Fix: Avoid a potential crash with very long ALPN protocol names + Fix: Make the call to a CertificateVerifier more robust + Fix: Avoid a potential crash when processing OCSP URLs + Fix: Make the processing of OCSP responses more robust + Fix: Stricter OCSP handling when soft-fail is disabled + Fix: Harden against the mis-use of Buffer.address(ByteBuffer) + Fix: Harden against the mis-use of Pool.destroy(long) Changes for tomcat10: - Update to Tomcat 10.1.60 + Fix: When a PersistentManager needs to reduce the number of active sessions, swap out the least recently used eligible sessions first. Pull request #1045 provided by sainadh777. (markt) + Fix: Align web.xml logging output with the new Context attribute urlPatternsProvidedInDecodedForm. (markt) + Fix: Improve robustness of DIGEST authentication to system clock jumps. (markt) + Add: Support multiple protocol header values (treat as a single merged header value) in the RemoteIpFilter and RemoteIpValve. (markt) + Fix: potential concurrency issues when loading/saving sessions from/to a session store. Custom Store implementations that do not extend StoreBase must implement the new getSessionStoreLock() method of the Store interface to ensure concurrency protection. The default method implementation provided only provides the pre-fix functionality. (markt) + Fix: Ensure that PersistentManager implementations that extend PersistentManagerBase do not swap out sessions that are associated with a request that is currently being processed. This includes not swapping out a session unless the session was created when activity tracking was enabled. (markt) + Fix: Ensure namespace attributes are XML escaped in WebDAV responses. + Fix: Resolve null or missing rewrite substitutions as an empty string, to align with the mod_rewrite behavior. (remm) + Add: a best efforts protection in the CrawlerSessionManagerValve against crawlers being associated with an authenticated session. (markt) + Fix: Clarify the meaning of various RewriteValve server variables and explicitly use the canonical context path for the CONTEXT_PATH server variable. (markt) + Fix: storeconfig not saving the path when a context is saved in server.xml. (remm) + Fix: WAR URLConnection should propagate use of caching. (remm) + Fix: Ensure resources are evicted from the static resource cache in the correct order. (markt) + Fix: When Jakarta Authentication is configured for a web application, cache the ServerAuthConfig in the Authenticator valve. This ensures web application specific settings are cached on a per web application basis. + Fix: 70203: Fix RegistrationListener notifications in Jakarta Authentication implementation. (markt) + Fix: Handle CGI scripts that write excessively to stdout after setting an HTTP error status code. (schultz) + Fix: Require the request to the login action during FORM authentication to be made using HTTP POST. (markt) + Fix: 70208: Make URL encoding more robust. Based on pull request #1065 by Chenjp. (markt) * Coyote + Fix: xreflection generated code stack overflow issue. (remm) + Fix: Align xreflection better with IntrospectionUtils. (remm) + Fix: In HTTP/2 after half closed (remote), any unexpected frame should be a stream error. (remm) + Fix: incorrect initial window size calculation when upgrading to HTTP/2. (remm) + Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm) + Fix: Only try and load the native library from the CATALINA_HOME system property when the property is set. (markt) + Fix: max connections enforcement after an enpoint resume. (remm) + Fix: Implement stricter ALPN matching for Connectors using FFM. (markt) + Add: length validation for ALPN protocol names. (markt) + Fix: Make FFM certificate verification more robust. (markt) + Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing failure as if no usable OCSP URLs were present. (markt) + Fix: Make the processing of OCSP responses more robust. (markt) + Fix: Stricter OCSP handling when soft-fail is disabled. (markt) + Fix: Cleaner handling of AJP response headers which overflow the maximum message size. (remm) + Fix: Small per performance optimisation. Don't waste cycles swallowing an AJP response body when the connection is going to be closed. (markt) + Fix: OpenSSL support for CRLs when using OpenSSL trust with the server key held in a Java key store. (markt) + Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding header. (markt) + Fix: Ensure per request HTTP/2 bad request marker is cleared when the request is recycled. (markt) + Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt) + Fix: Revert earlier refactoring of HTTP/2 header field validation that moved it earlier since the refactoring made correct handling of invalid headers more difficult. (markt) + Fix: EL evaluation of some lambda expressions. (remm) * WebSocket + Fix: an exception when an automatic Pong response races with the closing of the WebSocket session. (moritzfl) + Fix: Harden the WebSocket client and use a SecureRandom when generating the Sec-WebSocket-Key header. (markt) + Fix: Improve robustness of client handshakes. (remm) + Fix: Ensure that WebSocket write timeouts apply to the complete message and are not lost if two writes have the same timeout. (markt) + Fix: Reduce CPU usage while sending WebSocket close message. (markt) + Fix: overly broad check that prevented request URIs containing literal { and } characters from being mapped to WebSocket end points. (markt) + Fix: handling of WebSocket messages with compressed payloads using per- message-deflate that have one or more non-final blocks where the BFINAL bit is set. (markt) + Fix: handling of per-message-deflate context takeover when receiving compressed WebSocket messages. (markt) * Web applications + Fix: Manager: Fix a potential concurrency issue when ordering sessions prior to displaying a list of session. (markt) + Docs: Wrap the RewriteRule regular expression syntax reference on narrow displays. Pull request #1044 by sainadh777. (markt) * Other + Update: Easymock to 5.7.0. (markt) + Update: bnd to 7.4.0. (markt) + Update: Tomcat Native to 2.0.16. (markt) + Add: Improvements to French translations. (remm) + Add: Improvements to Japanese translations provided by tak7iji and Ktamura.biz.80. (markt) + Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a positive integer. Zero or negative values previously caused an infinite loop or a NegativeArraySizeException during session state transfer. Pull request #1042 provided by lihongyi87. (markt) + Fix: Improve robustness of cloud membership providers if an error occurs fetching members. (remm) * jdbc-pool + Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to getConnection(String,String) rather than getConnection(). (markt) + Add: Log a warning if an attempt is made to obtain a connection with credentials when alternateUsernameAllowed is set to false. (markt) + Fix: Ensure StatementCache interceptor resets properties of cached statements between uses. (mark) Changes for tomcat11: - Update to Tomcat 11.0.26 + Fix: Improve the handling of AsyncContext.dispatch() when the Context attribute dispatchersUseEncodedPaths is set to false since the application has no control over the path used for the AsyncContext.dispatch(). Prior to this fix, paths containing literal '?' characters were truncated. (markt) + Fix: Ensure that capture groups from a RewriteCond always reflect the result of the current request. (markt) + Fix: When a PersistentManager needs to reduce the number of active sessions, swap out the least recently used eligible sessions first. Pull request #1045 provided by sainadh777. (markt) + Fix: Align web.xml logging output with the new Context attribute urlPatternsProvidedInDecodedForm. (markt) + Fix: Improve robustness of DIGEST authentication to system clock jumps. (markt) + Add: Support multiple protocol header values (treat as a single merged header value) in the RemoteIpFilter and RemoteIpValve. (markt) + Fix: potential concurrency issues when loading/saving sessions from/to a session store. Custom Store implementations that do not extend StoreBase must implement the new getSessionStoreLock() method of the Store interface to ensure concurrency protection. The default method implementation provided only provides the pre-fix functionality. (markt) + Fix: Ensure that PersistentManager implementations that extend PersistentManagerBase do not swap out sessions that are associated with a request that is currently being processed. This includes not swapping out a session unless the session was created when activity tracking was enabled. (markt) + Fix: Ensure namespace attributes are XML escaped in WebDAV responses. + Fix: Resolve null or missing rewrite substitutions as an empty string, to align with the mod_rewrite behavior. (remm) + Add: a best efforts protection in the CrawlerSessionManagerValve against crawlers being associated with an authenticated session. (markt) + Fix: Clarify the meaning of various RewriteValve server variables and explicitly use the canonical context path for the CONTEXT_PATH server variable. (markt) + Fix: storeconfig not saving the path when a context is saved in server.xml. (remm) + Fix: WAR URLConnection should propagate use of caching. (remm) + Fix: Ensure resources are evicted from the static resource cache in the correct order. (markt) + Fix: When Jakarta Authentication is configured for a web application, cache the ServerAuthConfig in the Authenticator valve. This ensures web application specific settings are cached on a per web application basis. + Fix: 70203: Fix RegistrationListener notifications in Jakarta Authentication implementation. (markt) + Fix: Handle CGI scripts that write excessively to stdout after setting an HTTP error status code. (schultz) + Fix: Require the request to the login action during FORM authentication to be made using HTTP POST. (markt) + Fix: 70208: Make URL encoding more robust. Based on pull request #1065 by Chenjp. (markt) * Coyote + Fix: parsing of client certificates that specify more than one OCSP responder for configurations that use OpenSSL-FFM. (markt) + Fix: xreflection generated code stack overflow issue. (remm) + Fix: Align xreflection better with IntrospectionUtils. (remm) + Fix: In HTTP/2 after half closed (remote), any unexpected frame should be a stream error. (remm) + Fix: incorrect initial window size calculation when upgrading to HTTP/2. (remm) + Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm) + Fix: Only try and load the native library from the CATALINA_HOME system property when the property is set. (markt) + Fix: max connections enforcement after an enpoint resume. (remm) + Fix: Implement stricter ALPN matching for Connectors using FFM. (markt) + Add: length validation for ALPN protocol names. (markt) + Fix: Make FFM certificate verification more robust. (markt) + Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing failure as if no usable OCSP URLs were present. (markt) + Fix: Make the processing of OCSP responses more robust. (markt) + Fix: Stricter OCSP handling when soft-fail is disabled. (markt) + Fix: Cleaner handling of AJP response headers which overflow the maximum message size. (remm) + Fix: Small per performance optimisation. Don't waste cycles swallowing an AJP response body when the connection is going to be closed. (markt) + Fix: OpenSSL support for CRLs when using OpenSSL trust with the server key held in a Java key store. (markt) + Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding header. (markt) + Fix: Ensure per request HTTP/2 bad request marker is cleared when the request is recycled. (markt) + Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt) + Fix: Revert earlier refactoring of HTTP/2 header field validation that moved it earlier since the refactoring made correct handling of invalid headers more difficult. (markt) + Fix: EL evaluation of some lambda expressions. (remm) * WebSocket + Fix: an exception when an automatic Pong response races with the closing of the WebSocket session. (moritzfl) + Fix: Harden the WebSocket client and use a SecureRandom when generating the Sec-WebSocket-Key header. (markt) + Fix: Improve robustness of client handshakes. (remm) + Fix: Ensure that WebSocket write timeouts apply to the complete message and are not lost if two writes have the same timeout. (markt) + Fix: Reduce CPU usage while sending WebSocket close message. (markt) + Fix: overly broad check that prevented request URIs containing literal { and } characters from being mapped to WebSocket end points. (markt) + Fix: handling of WebSocket messages with compressed payloads using per- message-deflate that have one or more non-final blocks where the BFINAL bit is set. (markt) + Fix: handling of per-message-deflate context takeover when receiving compressed WebSocket messages. (markt) * Web applications + Fix: Manager: Fix a potential concurrency issue when ordering sessions prior to displaying a list of session. (markt) + Docs: Wrap the RewriteRule regular expression syntax reference on narrow displays. Pull request #1044 by sainadh777. (markt) * Other + Update: Easymock to 5.7.0. (markt) + Update: bnd to 7.4.0. (markt) + Update: Tomcat Native to 2.0.16. (markt) + Add: Improvements to French translations. (remm) + Add: Improvements to Japanese translations provided by tak7iji and Ktamura.biz.80. (markt) + Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a positive integer. Zero or negative values previously caused an infinite loop or a NegativeArraySizeException during session state transfer. Pull request #1042 provided by lihongyi87. (markt) + Fix: Improve robustness of cloud membership providers if an error occurs fetching members. (remm) * jdbc-pool + Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to getConnection(String,String) rather than getConnection(). (markt) + Add: Log a warning if an attempt is made to obtain a connection with credentials when alternateUsernameAllowed is set to false. (markt) + Fix: Ensure StatementCache interceptor resets properties of cached statements between uses. (mark) Changes for tomcat: - Update to Tomcat 9.0.122 + Fix: Improve the handling of AsyncContext.dispatch() when the Context attribute dispatchersUseEncodedPaths is set to false since the application has no control over the path used for the AsyncContext.dispatch(). Prior to this fix, paths containing literal '?' characters were truncated. (markt) + Fix: Ensure that capture groups from a RewriteCond always reflect the result of the current request. (markt) + Fix: When a PersistentManager needs to reduce the number of active sessions, swap out the least recently used eligible sessions first. Pull request #1045 provided by sainadh777. (markt) + Fix: Align web.xml logging output with the new Context attribute urlPatternsProvidedInDecodedForm. (markt) + Fix: Improve robustness of DIGEST authentication to system clock jumps. (markt) + Add: Support multiple protocol header values (treat as a single merged header value) in the RemoteIpFilter and RemoteIpValve. (markt) + Fix: potential concurrency issues when loading/saving sessions from/to a session store. Custom Store implementations that do not extend StoreBase must implement the new getSessionStoreLock() method of the Store interface to ensure concurrency protection. The default method implementation provided only provides the pre-fix functionality. (markt) + Fix: Ensure that PersistentManager implementations that extend PersistentManagerBase do not swap out sessions that are associated with a request that is currently being processed. As a result, it is now a requirement that the system property org.apache.catalina.session.StandardSession.ACTIVITY_CHECK is set to true (either explicitly or via STRICT_SERVLET_COMPLIANCE) if either minIdleSwap or maxIdleSwap are configured. (markt) * Coyote + Fix: xreflection generated code stack overflow issue. (remm) + Fix: Align xreflection better with IntrospectionUtils. (remm) + Fix: In HTTP/2 after half closed (remote), any unexpected frame should be a stream error. (remm) + Fix: incorrect initial window size calculation when upgrading to HTTP/2. (remm) + Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm) + Fix: Only try and load the native library from the CATALINA_HOME system property when the property is set. (markt) + Fix: max connections enforcement after an enpoint resume. (remm) + Fix: Implement stricter ALPN matching for Connectors using FFM. (markt) + Add: length validation for ALPN protocol names. (markt) + Fix: Make FFM certificate verification more robust. (markt) + Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing failure as if no usable OCSP URLs were present. (markt) + Fix: Make the processing of OCSP responses more robust. (markt) + Fix: Stricter OCSP handling when soft-fail is disabled. (markt) + Fix: Cleaner handling of AJP response headers which overflow the maximum message size. (remm) + Fix: Small per performance optimisation. Don't waste cycles swallowing an AJP response body when the connection is going to be closed. (markt) + Fix: OpenSSL support for CRLs when using OpenSSL trust with the server key held in a Java key store. (markt) + Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding header. (markt) + Fix: Ensure per request HTTP/2 bad request marker is cleared when the request is recycled. (markt) + Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt) + Fix: Revert earlier refactoring of HTTP/2 header field validation that moved it earlier since the refactoring made correct handling of invalid headers more difficult. (markt) + Fix: EL evaluation of some lambda expressions. (remm) * WebSocket + Fix: an exception when an automatic Pong response races with the closing of the WebSocket session. (moritzfl) + Fix: Harden the WebSocket client and use a SecureRandom when generating the Sec-WebSocket-Key header. (markt) + Fix: Improve robustness of client handshakes. (remm) + Fix: Ensure that WebSocket write timeouts apply to the complete message and are not lost if two writes have the same timeout. (markt) + Fix: Reduce CPU usage while sending WebSocket close message. (markt) + Fix: overly broad check that prevented request URIs containing literal { and } characters from being mapped to WebSocket end points. (markt) + Fix: handling of WebSocket messages with compressed payloads using per- message-deflate that have one or more non-final blocks where the BFINAL bit is set. (markt) + Fix: handling of per-message-deflate context takeover when receiving compressed WebSocket messages. (markt) * Web applications + Fix: Manager: Fix a potential concurrency issue when ordering sessions prior to displaying a list of session. (markt) + Docs: Wrap the RewriteRule regular expression syntax reference on narrow displays. Pull request #1044 by sainadh777. (markt) * Other + Update: Easymock to 5.7.0. (markt) + Update: bnd to 7.4.0. (markt) + Update: Tomcat Native to 1.3.9. (markt) + Add: Improvements to French translations. (remm) + Add: Improvements to Japanese translations provided by tak7iji and Ktamura.biz.80. (markt) + Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a positive integer. Zero or negative values previously caused an infinite loop or a NegativeArraySizeException during session state transfer. Pull request #1042 provided by lihongyi87. (markt) + Fix: Improve robustness of cloud membership providers if an error occurs fetching members. (remm) * jdbc-pool + Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to getConnection(String,String) rather than getConnection(). (markt) + Add: Log a warning if an attempt is made to obtain a connection with credentials when alternateUsernameAllowed is set to false. (markt) + Fix: Ensure StatementCache interceptor resets properties of cached statements between uses. (mark)
Patchnames: openSUSE-Leap-16.0-1795
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-73581
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch —
Vendor Fix
Threats
Impact moderate
CVE-2026-75973
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact moderate
CVE-2026-76183
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact critical
CVE-2026-77756
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact low
CVE-2026-77762
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact low
CVE-2026-77791
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact important
CVE-2026-78383
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact important
CVE-2026-78437
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact low
CVE-2026-79677
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact important
CVE-2026-86243
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact important
CVE-2026-86246
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact moderate
CVE-2026-86247
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact important
CVE-2026-86248
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact critical
CVE-2026-86350
7.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact important
CVE-2026-87022
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Recommended 49 products, the same list as for CVE-2026-73581
Threats
Impact moderate
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://bugzilla.suse.com/1282581 self
https://bugzilla.suse.com/1282599 self
https://bugzilla.suse.com/1282620 self
https://bugzilla.suse.com/1282621 self
https://bugzilla.suse.com/1282622 self
https://bugzilla.suse.com/1282623 self
https://bugzilla.suse.com/1282624 self
https://bugzilla.suse.com/1282625 self
https://bugzilla.suse.com/1282626 self
https://bugzilla.suse.com/1282627 self
https://bugzilla.suse.com/1282628 self
https://bugzilla.suse.com/1282629 self
https://bugzilla.suse.com/1282630 self
https://bugzilla.suse.com/1282631 self
https://bugzilla.suse.com/1282787 self
https://bugzilla.suse.com/622430 self
https://www.suse.com/security/cve/CVE-2026-73581/ self
https://www.suse.com/security/cve/CVE-2026-75973/ self
https://www.suse.com/security/cve/CVE-2026-76183/ self
https://www.suse.com/security/cve/CVE-2026-77756/ self
https://www.suse.com/security/cve/CVE-2026-77762/ self
https://www.suse.com/security/cve/CVE-2026-77791/ self
https://www.suse.com/security/cve/CVE-2026-78383/ self
https://www.suse.com/security/cve/CVE-2026-78437/ self
https://www.suse.com/security/cve/CVE-2026-79677/ self
https://www.suse.com/security/cve/CVE-2026-86243/ self
https://www.suse.com/security/cve/CVE-2026-86246/ self
https://www.suse.com/security/cve/CVE-2026-86247/ self
https://www.suse.com/security/cve/CVE-2026-86248/ self
https://www.suse.com/security/cve/CVE-2026-86350/ self
https://www.suse.com/security/cve/CVE-2026-87022/ self
https://www.suse.com/security/cve/CVE-2026-73581 external
https://bugzilla.suse.com/1282631 external
https://www.suse.com/security/cve/CVE-2026-75973 external
https://bugzilla.suse.com/1282630 external
https://www.suse.com/security/cve/CVE-2026-76183 external
https://bugzilla.suse.com/1282629 external
https://www.suse.com/security/cve/CVE-2026-77756 external
https://bugzilla.suse.com/1282628 external
https://www.suse.com/security/cve/CVE-2026-77762 external
https://bugzilla.suse.com/1282599 external
https://www.suse.com/security/cve/CVE-2026-77791 external
https://bugzilla.suse.com/1282627 external
https://www.suse.com/security/cve/CVE-2026-78383 external
https://bugzilla.suse.com/1282626 external
https://www.suse.com/security/cve/CVE-2026-78437 external
https://bugzilla.suse.com/1282625 external
https://www.suse.com/security/cve/CVE-2026-79677 external
https://bugzilla.suse.com/1282624 external
https://www.suse.com/security/cve/CVE-2026-86243 external
https://bugzilla.suse.com/1282623 external
https://www.suse.com/security/cve/CVE-2026-86246 external
https://bugzilla.suse.com/1282622 external
https://www.suse.com/security/cve/CVE-2026-86247 external
https://bugzilla.suse.com/1282621 external
https://www.suse.com/security/cve/CVE-2026-86248 external
https://bugzilla.suse.com/1282620 external
https://www.suse.com/security/cve/CVE-2026-86350 external
https://bugzilla.suse.com/1265163 external
https://bugzilla.suse.com/1282787 external
https://www.suse.com/security/cve/CVE-2026-87022 external
https://bugzilla.suse.com/1282581 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for libtcnative-1-0, libtcnative-2-0, tomcat, tomcat10, tomcat11",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for libtcnative-1-0, libtcnative-2-0, tomcat, tomcat10, tomcat11 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore\n  (bsc#1282631).\n- CVE-2026-75973: improper authentication when Jakarta authentication is configured with `SimpleAuthConfigProvider`\n  (bsc#1282630).\n- CVE-2026-76183: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629).\n- CVE-2026-77756: inconsistent interpretation of HTTP requests allows an attacker to cause one request from another user\n  to fail when Tomcat is located behind a reverse proxy (bsc#1282628).\n- CVE-2026-77762: Apache Tomcat: Stale HPACK emitter injects trailers (bsc#1282599).\n- CVE-2026-77791: uncontrolled resource consumption when sending WebSocket close message enabled a DoS attack\n  (bsc#1282627).\n- CVE-2026-78383: allocation of resources without limits or throttling allows an unauthenticated AJP request to pin an\n  AJP processing thread leading to denial of service (bsc#1282626).\n- CVE-2026-78437: incomplete cleanup allows a malformed request to potentially cause requests from another user to fail\n  (bsc#1282625).\n- CVE-2026-79677: missing release of resource after effective lifetime and comparison using wrong factors allows for\n  denial of service due to lost time outs for asynchronous WebSocket writes (bsc#1282624).\n- CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash\n  (bsc#1282623).\n- CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and\n  ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622).\n- CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for some\n  configurations (bsc#1282621).\n- CVE-2026-86248: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled\n  (bsc#1282620).\n- CVE-2026-86350: HTTP/2 requests can cause request header mix-ups and HTTP request smuggling (bsc#1282787).\n- CVE-2026-87022: Apache Tomcat: WebSocket message smuggling with (bsc#1282581).\n\nNon security issue fixed:\n\n- package libtcnative-1-0-devel houses link to libtcnative-1.so instead of package libtcnative-1-0 (bsc#622430).\n\nChanges for libtcnative-1-0:\n\n- Update to 1.3.9\n + Code: Remove call to ERR_remove_thread_state() from Windows\n specific code to allow building with OpenSSL 4.0.x.\n ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got\n removed in OpenSSL 4\n + Fix: Fix a potential crash when negotiating ALPN\n + If ALPN negotiation fails and failure is configured to use\n the last server protocol in the list, use it rather than the\n last protocol offered by the client\n + Fix: Add support for the extended range of options available\n from OpenSSL 3.0.x. The options flag is now a 64-bit unsigned\n int (represented by a Java long) rather than a 32-bit unsigned\n int (represented by a Java int)\n + Code: Remove unused code\n + Ensure that per connection changes to certificate verification\n settings, e.g. to support client certificate authentication,\n do not modify the certificate verification settings for other\n connections\n + Fix: Fix a potential crash when configuring raw certificates\n + Fix: Avoid a potential crash with very long ALPN protocol\n names\n + Fix: Make the call to a CertificateVerifier more robust\n + Fix: Avoid a potential crash when processing OCSP URLs\n + Fix: Make the processing of OCSP responses more robust\n + Fix: Stricter OCSP handling when soft-fail is disabled\n + Fix: Harden against the mis-use of Buffer.address(ByteBuffer)\n + Fix: Harden against the mis-use of Pool.destroy(long)\n + Code: The minimum supported OpenSSL version is now 3.0.x.\n OpenSSL 1.1.1 support was accidentally broken in 1.3.8. As no\n bug reports were receive for that failure and since both\n Debian and Ubuntu versions that used OpenSSL 1.1.1 have\n reached end of support, OpenSSL 1.1.1 is no longer supported\n + Update: OpenSSL 3.0.x is approaching end of support so the\n recommended version of OpenSSL (and the version that windows\n binaries will be built with) now follows the 3.5.x LTS branch\n + Fix: Switch to automatic configuration of DH parameters.\n Manual configuration attempts will be ignored\n + Code: Make setTmpECDHByCurveName() a NO-OP\n + Fix: Refactor extraction of ECDH curve name from the\n Certificate to avoid deprecated OpenSSL methods\n + Fix: Refactor the native implementation of SSL.getTime() to\n avoid the Y2038 problem in SSL_SESSION_get_time() when running\n on a verion of OpenSSL that includes the new\n SSL_SESSION_get_time_ex() method\n\nChanges for libtcnative-2-0:\n\n- Upgrade to version 2.0.16\n + Code: Remove call to ERR_remove_thread_state() from Windows\n specific code to allow building with OpenSSL 4.0.x\n ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got\n removed in OpenSSL 4\n + Update: Remove support for Windows build on IA64 architecture\n (Itanium)\n + Update: Make x64 the default architecture for Windows build\n + Update: Make Windows 10 / 11 the default target version for\n Windows builds\n + Fix: Fix a potential crash when negotiating ALPN\n + Fix: If ALPN negotiation fails and failure is configured to\n use the last server protocol in the list, use it rather than\n the last protocol offered by the client\n + Fix: Add support for the extended range of options available\n from OpenSSL 3.0.x. The options flag is now a 64-bit unsigned\n int (represented by a Java long) rather than a 32-bit unsigned\n int (represented by a Java int)\n + Code: Remove unused code\n + Fix: Ensure that per connection changes to certificate\n verification settings, e.g. to support client certificate\n authentication, do not modify the certificate verification\n settings for other connections\n + Fix: Fix a potential crash when configuring raw certificates\n + Fix: Avoid a potential crash with very long ALPN protocol\n names\n + Fix: Make the call to a CertificateVerifier more robust\n + Fix: Avoid a potential crash when processing OCSP URLs\n + Fix: Make the processing of OCSP responses more robust\n + Fix: Stricter OCSP handling when soft-fail is disabled\n + Fix: Harden against the mis-use of Buffer.address(ByteBuffer)\n + Fix: Harden against the mis-use of Pool.destroy(long)\n\nChanges for tomcat10:\n\n- Update to Tomcat 10.1.60\n + Fix: When a PersistentManager needs to reduce the number of active\n sessions, swap out the least recently used eligible sessions first. Pull\n request #1045 provided by sainadh777. (markt)\n + Fix: Align web.xml logging output with the new Context attribute\n urlPatternsProvidedInDecodedForm. (markt)\n + Fix: Improve robustness of DIGEST authentication to system clock jumps.\n (markt)\n + Add: Support multiple protocol header values (treat as a single merged\n header value) in the RemoteIpFilter and RemoteIpValve. (markt)\n + Fix: potential concurrency issues when loading/saving sessions from/to a\n session store. Custom Store implementations that do not extend StoreBase\n must implement the new getSessionStoreLock() method of the Store\n interface to ensure concurrency protection. The default method\n implementation provided only provides the pre-fix functionality. (markt)\n + Fix: Ensure that PersistentManager implementations that extend\n PersistentManagerBase do not swap out sessions that are associated with\n a request that is currently being processed. This includes not swapping\n out a session unless the session was created when activity tracking was\n enabled. (markt)\n + Fix: Ensure namespace attributes are XML escaped in WebDAV responses.\n + Fix: Resolve null or missing rewrite substitutions as an empty string,\n to align with the mod_rewrite behavior. (remm)\n + Add: a best efforts protection in the CrawlerSessionManagerValve against\n crawlers being associated with an authenticated session. (markt)\n + Fix: Clarify the meaning of various RewriteValve server variables and\n explicitly use the canonical context path for the CONTEXT_PATH server\n variable. (markt)\n + Fix: storeconfig not saving the path when a context is saved in\n server.xml. (remm)\n + Fix: WAR URLConnection should propagate use of caching. (remm)\n + Fix: Ensure resources are evicted from the static resource cache in the\n correct order. (markt)\n + Fix: When Jakarta Authentication is configured for a web application,\n cache the ServerAuthConfig in the Authenticator valve. This ensures web\n application specific settings are cached on a per web application basis.\n + Fix: 70203: Fix RegistrationListener notifications in Jakarta\n Authentication implementation. (markt)\n + Fix: Handle CGI scripts that write excessively to stdout after setting\n an HTTP error status code. (schultz)\n + Fix: Require the request to the login action during FORM authentication\n to be made using HTTP POST. (markt)\n + Fix: 70208: Make URL encoding more robust. Based on pull request #1065\n by Chenjp. (markt)\n * Coyote\n + Fix: xreflection generated code stack overflow issue. (remm)\n + Fix: Align xreflection better with IntrospectionUtils. (remm)\n + Fix: In HTTP/2 after half closed (remote), any unexpected frame should\n be a stream error. (remm)\n + Fix: incorrect initial window size calculation when upgrading to HTTP/2.\n (remm)\n + Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm)\n + Fix: Only try and load the native library from the CATALINA_HOME system\n property when the property is set. (markt)\n + Fix: max connections enforcement after an enpoint resume. (remm)\n + Fix: Implement stricter ALPN matching for Connectors using FFM. (markt)\n + Add: length validation for ALPN protocol names. (markt)\n + Fix: Make FFM certificate verification more robust. (markt)\n + Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing\n failure as if no usable OCSP URLs were present. (markt)\n + Fix: Make the processing of OCSP responses more robust. (markt)\n + Fix: Stricter OCSP handling when soft-fail is disabled. (markt)\n + Fix: Cleaner handling of AJP response headers which overflow the maximum\n message size. (remm)\n + Fix: Small per performance optimisation. Don\u0027t waste cycles swallowing\n an AJP response body when the connection is going to be closed. (markt)\n + Fix: OpenSSL support for CRLs when using OpenSSL trust with the server\n key held in a Java key store. (markt)\n + Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding\n header. (markt)\n + Fix: Ensure per request HTTP/2 bad request marker is cleared when the\n request is recycled. (markt)\n + Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt)\n + Fix: Revert earlier refactoring of HTTP/2 header field validation that\n moved it earlier since the refactoring made correct handling of invalid\n headers more difficult. (markt)\n + Fix: EL evaluation of some lambda expressions. (remm)\n * WebSocket\n + Fix: an exception when an automatic Pong response races with the closing\n of the WebSocket session. (moritzfl)\n + Fix: Harden the WebSocket client and use a SecureRandom when generating\n the Sec-WebSocket-Key header. (markt)\n + Fix: Improve robustness of client handshakes. (remm)\n + Fix: Ensure that WebSocket write timeouts apply to the complete message\n and are not lost if two writes have the same timeout. (markt)\n + Fix: Reduce CPU usage while sending WebSocket close message. (markt)\n + Fix: overly broad check that prevented request URIs containing literal {\n and } characters from being mapped to WebSocket end points. (markt)\n + Fix: handling of WebSocket messages with compressed payloads using per-\n message-deflate that have one or more non-final blocks where the BFINAL\n bit is set. (markt)\n + Fix: handling of per-message-deflate context takeover when receiving\n compressed WebSocket messages. (markt)\n * Web applications\n + Fix: Manager: Fix a potential concurrency issue when ordering sessions\n prior to displaying a list of session. (markt)\n + Docs: Wrap the RewriteRule regular expression syntax reference on narrow\n displays. Pull request #1044 by sainadh777. (markt)\n * Other\n + Update: Easymock to 5.7.0. (markt)\n + Update: bnd to 7.4.0. (markt)\n + Update: Tomcat Native to 2.0.16. (markt)\n + Add: Improvements to French translations. (remm)\n + Add: Improvements to Japanese translations provided by tak7iji and\n Ktamura.biz.80. (markt)\n + Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a\n positive integer. Zero or negative values previously caused an infinite\n loop or a NegativeArraySizeException during session state transfer. Pull\n request #1042 provided by lihongyi87. (markt)\n + Fix: Improve robustness of cloud membership providers if an error occurs\n fetching members. (remm)\n * jdbc-pool\n + Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to\n getConnection(String,String) rather than getConnection(). (markt)\n + Add: Log a warning if an attempt is made to obtain a connection with\n credentials when alternateUsernameAllowed is set to false. (markt)\n + Fix: Ensure StatementCache interceptor resets properties of cached\n statements between uses. (mark)\n\nChanges for tomcat11:\n\n- Update to Tomcat 11.0.26\n + Fix: Improve the handling of AsyncContext.dispatch() when the Context\n attribute dispatchersUseEncodedPaths is set to false since the\n application has no control over the path used for the\n AsyncContext.dispatch(). Prior to this fix, paths containing literal \u0027?\u0027\n characters were truncated. (markt)\n + Fix: Ensure that capture groups from a RewriteCond always reflect the\n result of the current request. (markt)\n + Fix: When a PersistentManager needs to reduce the number of active\n sessions, swap out the least recently used eligible sessions first. Pull\n request #1045 provided by sainadh777. (markt)\n + Fix: Align web.xml logging output with the new Context attribute\n urlPatternsProvidedInDecodedForm. (markt)\n + Fix: Improve robustness of DIGEST authentication to system clock jumps.\n (markt)\n + Add: Support multiple protocol header values (treat as a single merged\n header value) in the RemoteIpFilter and RemoteIpValve. (markt)\n + Fix: potential concurrency issues when loading/saving sessions from/to a\n session store. Custom Store implementations that do not extend StoreBase\n must implement the new getSessionStoreLock() method of the Store\n interface to ensure concurrency protection. The default method\n implementation provided only provides the pre-fix functionality. (markt)\n + Fix: Ensure that PersistentManager implementations that extend\n PersistentManagerBase do not swap out sessions that are associated with\n a request that is currently being processed. This includes not swapping\n out a session unless the session was created when activity tracking was\n enabled. (markt)\n + Fix: Ensure namespace attributes are XML escaped in WebDAV responses.\n + Fix: Resolve null or missing rewrite substitutions as an empty string,\n to align with the mod_rewrite behavior. (remm)\n + Add: a best efforts protection in the CrawlerSessionManagerValve against\n crawlers being associated with an authenticated session. (markt)\n + Fix: Clarify the meaning of various RewriteValve server variables and\n explicitly use the canonical context path for the CONTEXT_PATH server\n variable. (markt)\n + Fix: storeconfig not saving the path when a context is saved in\n server.xml. (remm)\n + Fix: WAR URLConnection should propagate use of caching. (remm)\n + Fix: Ensure resources are evicted from the static resource cache in the\n correct order. (markt)\n + Fix: When Jakarta Authentication is configured for a web application,\n cache the ServerAuthConfig in the Authenticator valve. This ensures web\n application specific settings are cached on a per web application basis.\n + Fix: 70203: Fix RegistrationListener notifications in Jakarta\n Authentication implementation. (markt)\n + Fix: Handle CGI scripts that write excessively to stdout after setting\n an HTTP error status code. (schultz)\n + Fix: Require the request to the login action during FORM authentication\n to be made using HTTP POST. (markt)\n + Fix: 70208: Make URL encoding more robust. Based on pull request #1065\n by Chenjp. (markt)\n * Coyote\n + Fix: parsing of client certificates that specify more than one OCSP\n responder for configurations that use OpenSSL-FFM. (markt)\n + Fix: xreflection generated code stack overflow issue. (remm)\n + Fix: Align xreflection better with IntrospectionUtils. (remm)\n + Fix: In HTTP/2 after half closed (remote), any unexpected frame should\n be a stream error. (remm)\n + Fix: incorrect initial window size calculation when upgrading to HTTP/2.\n (remm)\n + Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm)\n + Fix: Only try and load the native library from the CATALINA_HOME system\n property when the property is set. (markt)\n + Fix: max connections enforcement after an enpoint resume. (remm)\n + Fix: Implement stricter ALPN matching for Connectors using FFM. (markt)\n + Add: length validation for ALPN protocol names. (markt)\n + Fix: Make FFM certificate verification more robust. (markt)\n + Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing\n failure as if no usable OCSP URLs were present. (markt)\n + Fix: Make the processing of OCSP responses more robust. (markt)\n + Fix: Stricter OCSP handling when soft-fail is disabled. (markt)\n + Fix: Cleaner handling of AJP response headers which overflow the maximum\n message size. (remm)\n + Fix: Small per performance optimisation. Don\u0027t waste cycles swallowing\n an AJP response body when the connection is going to be closed. (markt)\n + Fix: OpenSSL support for CRLs when using OpenSSL trust with the server\n key held in a Java key store. (markt)\n + Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding\n header. (markt)\n + Fix: Ensure per request HTTP/2 bad request marker is cleared when the\n request is recycled. (markt)\n + Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt)\n + Fix: Revert earlier refactoring of HTTP/2 header field validation that\n moved it earlier since the refactoring made correct handling of invalid\n headers more difficult. (markt)\n + Fix: EL evaluation of some lambda expressions. (remm)\n * WebSocket\n + Fix: an exception when an automatic Pong response races with the closing\n of the WebSocket session. (moritzfl)\n + Fix: Harden the WebSocket client and use a SecureRandom when generating\n the Sec-WebSocket-Key header. (markt)\n + Fix: Improve robustness of client handshakes. (remm)\n + Fix: Ensure that WebSocket write timeouts apply to the complete message\n and are not lost if two writes have the same timeout. (markt)\n + Fix: Reduce CPU usage while sending WebSocket close message. (markt)\n + Fix: overly broad check that prevented request URIs containing literal {\n and } characters from being mapped to WebSocket end points. (markt)\n + Fix: handling of WebSocket messages with compressed payloads using per-\n message-deflate that have one or more non-final blocks where the BFINAL\n bit is set. (markt)\n + Fix: handling of per-message-deflate context takeover when receiving\n compressed WebSocket messages. (markt)\n * Web applications\n + Fix: Manager: Fix a potential concurrency issue when ordering sessions\n prior to displaying a list of session. (markt)\n + Docs: Wrap the RewriteRule regular expression syntax reference on narrow\n displays. Pull request #1044 by sainadh777. (markt)\n * Other\n + Update: Easymock to 5.7.0. (markt)\n + Update: bnd to 7.4.0. (markt)\n + Update: Tomcat Native to 2.0.16. (markt)\n + Add: Improvements to French translations. (remm)\n + Add: Improvements to Japanese translations provided by tak7iji and\n Ktamura.biz.80. (markt)\n + Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a\n positive integer. Zero or negative values previously caused an infinite\n loop or a NegativeArraySizeException during session state transfer. Pull\n request #1042 provided by lihongyi87. (markt)\n + Fix: Improve robustness of cloud membership providers if an error occurs\n fetching members. (remm)\n * jdbc-pool\n + Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to\n getConnection(String,String) rather than getConnection(). (markt)\n + Add: Log a warning if an attempt is made to obtain a connection with\n credentials when alternateUsernameAllowed is set to false. (markt)\n + Fix: Ensure StatementCache interceptor resets properties of cached\n statements between uses. (mark)\n\nChanges for tomcat:\n\n- Update to Tomcat 9.0.122\n + Fix: Improve the handling of AsyncContext.dispatch() when the Context\n attribute dispatchersUseEncodedPaths is set to false since the\n application has no control over the path used for the\n AsyncContext.dispatch(). Prior to this fix, paths containing literal \u0027?\u0027\n characters were truncated. (markt)\n + Fix: Ensure that capture groups from a RewriteCond always reflect the\n result of the current request. (markt)\n + Fix: When a PersistentManager needs to reduce the number of active\n sessions, swap out the least recently used eligible sessions first. Pull\n request #1045 provided by sainadh777. (markt)\n + Fix: Align web.xml logging output with the new Context attribute\n urlPatternsProvidedInDecodedForm. (markt)\n + Fix: Improve robustness of DIGEST authentication to system clock jumps.\n (markt)\n + Add: Support multiple protocol header values (treat as a single merged\n header value) in the RemoteIpFilter and RemoteIpValve. (markt)\n + Fix: potential concurrency issues when loading/saving sessions from/to a\n session store. Custom Store implementations that do not extend StoreBase\n must implement the new getSessionStoreLock() method of the Store\n interface to ensure concurrency protection. The default method\n implementation provided only provides the pre-fix functionality. (markt)\n + Fix: Ensure that PersistentManager implementations that extend\n PersistentManagerBase do not swap out sessions that are associated with\n a request that is currently being processed. As a result, it is now a\n requirement that the system property\n org.apache.catalina.session.StandardSession.ACTIVITY_CHECK is set to\n true (either explicitly or via STRICT_SERVLET_COMPLIANCE) if either\n minIdleSwap or maxIdleSwap are configured. (markt)\n * Coyote\n + Fix: xreflection generated code stack overflow issue. (remm)\n + Fix: Align xreflection better with IntrospectionUtils. (remm)\n + Fix: In HTTP/2 after half closed (remote), any unexpected frame should\n be a stream error. (remm)\n + Fix: incorrect initial window size calculation when upgrading to HTTP/2.\n (remm)\n + Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm)\n + Fix: Only try and load the native library from the CATALINA_HOME system\n property when the property is set. (markt)\n + Fix: max connections enforcement after an enpoint resume. (remm)\n + Fix: Implement stricter ALPN matching for Connectors using FFM. (markt)\n + Add: length validation for ALPN protocol names. (markt)\n + Fix: Make FFM certificate verification more robust. (markt)\n + Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing\n failure as if no usable OCSP URLs were present. (markt)\n + Fix: Make the processing of OCSP responses more robust. (markt)\n + Fix: Stricter OCSP handling when soft-fail is disabled. (markt)\n + Fix: Cleaner handling of AJP response headers which overflow the maximum\n message size. (remm)\n + Fix: Small per performance optimisation. Don\u0027t waste cycles swallowing\n an AJP response body when the connection is going to be closed. (markt)\n + Fix: OpenSSL support for CRLs when using OpenSSL trust with the server\n key held in a Java key store. (markt)\n + Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding\n header. (markt)\n + Fix: Ensure per request HTTP/2 bad request marker is cleared when the\n request is recycled. (markt)\n + Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt)\n + Fix: Revert earlier refactoring of HTTP/2 header field validation that\n moved it earlier since the refactoring made correct handling of invalid\n headers more difficult. (markt)\n + Fix: EL evaluation of some lambda expressions. (remm)\n * WebSocket\n + Fix: an exception when an automatic Pong response races with the closing\n of the WebSocket session. (moritzfl)\n + Fix: Harden the WebSocket client and use a SecureRandom when generating\n the Sec-WebSocket-Key header. (markt)\n + Fix: Improve robustness of client handshakes. (remm)\n + Fix: Ensure that WebSocket write timeouts apply to the complete message\n and are not lost if two writes have the same timeout. (markt)\n + Fix: Reduce CPU usage while sending WebSocket close message. (markt)\n + Fix: overly broad check that prevented request URIs containing literal {\n and } characters from being mapped to WebSocket end points. (markt)\n + Fix: handling of WebSocket messages with compressed payloads using per-\n message-deflate that have one or more non-final blocks where the BFINAL\n bit is set. (markt)\n + Fix: handling of per-message-deflate context takeover when receiving\n compressed WebSocket messages. (markt)\n * Web applications\n + Fix: Manager: Fix a potential concurrency issue when ordering sessions\n prior to displaying a list of session. (markt)\n + Docs: Wrap the RewriteRule regular expression syntax reference on narrow\n displays. Pull request #1044 by sainadh777. (markt)\n * Other\n + Update: Easymock to 5.7.0. (markt)\n + Update: bnd to 7.4.0. (markt)\n + Update: Tomcat Native to 1.3.9. (markt)\n + Add: Improvements to French translations. (remm)\n + Add: Improvements to Japanese translations provided by tak7iji and\n Ktamura.biz.80. (markt)\n + Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a\n positive integer. Zero or negative values previously caused an infinite\n loop or a NegativeArraySizeException during session state transfer. Pull\n request #1042 provided by lihongyi87. (markt)\n + Fix: Improve robustness of cloud membership providers if an error occurs\n fetching members. (remm)\n * jdbc-pool\n + Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to\n getConnection(String,String) rather than getConnection(). (markt)\n + Add: Log a warning if an attempt is made to obtain a connection with\n credentials when alternateUsernameAllowed is set to false. (markt)\n + Fix: Ensure StatementCache interceptor resets properties of cached\n statements between uses. (mark)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-1795",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21984-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282581",
        "url": "https://bugzilla.suse.com/1282581"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282599",
        "url": "https://bugzilla.suse.com/1282599"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282620",
        "url": "https://bugzilla.suse.com/1282620"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282621",
        "url": "https://bugzilla.suse.com/1282621"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282622",
        "url": "https://bugzilla.suse.com/1282622"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282623",
        "url": "https://bugzilla.suse.com/1282623"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282624",
        "url": "https://bugzilla.suse.com/1282624"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282625",
        "url": "https://bugzilla.suse.com/1282625"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282626",
        "url": "https://bugzilla.suse.com/1282626"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282627",
        "url": "https://bugzilla.suse.com/1282627"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282628",
        "url": "https://bugzilla.suse.com/1282628"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282629",
        "url": "https://bugzilla.suse.com/1282629"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282630",
        "url": "https://bugzilla.suse.com/1282630"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282631",
        "url": "https://bugzilla.suse.com/1282631"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282787",
        "url": "https://bugzilla.suse.com/1282787"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 622430",
        "url": "https://bugzilla.suse.com/622430"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-73581 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-73581/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-75973 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-75973/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-76183 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-76183/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-77756 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-77756/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-77762 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-77762/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-77791 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-77791/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-78383 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-78383/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-78437 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-78437/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-79677 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-79677/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-86243 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-86243/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-86246 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-86246/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-86247 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-86247/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-86248 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-86248/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-86350 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-86350/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-87022 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-87022/"
      }
    ],
    "title": "Security update for libtcnative-1-0, libtcnative-2-0, tomcat, tomcat10, tomcat11",
    "tracking": {
      "current_release_date": "2026-10-01T16:39:40Z",
      "generator": {
        "date": "2026-09-30T17:58:26Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21984-1",
      "initial_release_date": "2026-09-30T17:58:26Z",
      "revision_history": [
        {
          "date": "2026-09-30T17:58:26Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-01T16:39:40Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
                "product": {
                  "name": "libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
                  "product_id": "libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-1-0@1.3.9-160000.1.1?arch=aarch64\u0026upstream=libtcnative-1-0-0:1.3.9-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
                "product": {
                  "name": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
                  "product_id": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-1-0-devel@1.3.9-160000.1.1?arch=aarch64\u0026upstream=libtcnative-1-0-0:1.3.9-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
                "product": {
                  "name": "libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
                  "product_id": "libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-2-0@2.0.16-160000.1.1?arch=aarch64\u0026upstream=libtcnative-2-0-0:2.0.16-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
                "product": {
                  "name": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
                  "product_id": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-2-0-devel@2.0.16-160000.1.1?arch=aarch64\u0026upstream=libtcnative-2-0-0:2.0.16-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-0:9.0.122-160000.1.1.noarch",
                "product": {
                  "name": "tomcat-0:9.0.122-160000.1.1.noarch",
                  "product_id": "tomcat-0:9.0.122-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.122:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat@9.0.122-160000.1.1?arch=noarch\u0026upstream=tomcat-0:9.0.122-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
                "product": {
                  "name": "tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
                  "product_id": "tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.122:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-admin-webapps@9.0.122-160000.1.1?arch=noarch\u0026upstream=tomcat-0:9.0.122-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
                "product": {
                  "name": "tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
                  "product_id": "tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.122:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-docs-webapp@9.0.122-160000.1.1?arch=noarch\u0026upstream=tomcat-0:9.0.122-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
                "product": {
                  "name": "tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
                  "product_id": "tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.122:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-el-3_0-api@9.0.122-160000.1.1?arch=noarch\u0026upstream=tomcat-0:9.0.122-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-embed-0:9.0.122-160000.1.1.noarch",
                "product": {
                  "name": "tomcat-embed-0:9.0.122-160000.1.1.noarch",
                  "product_id": "tomcat-embed-0:9.0.122-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.122:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-embed@9.0.122-160000.1.1?arch=noarch\u0026upstream=tomcat-0:9.0.122-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
                "product": {
                  "name": "tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
                  "product_id": "tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.122:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-javadoc@9.0.122-160000.1.1?arch=noarch\u0026upstream=tomcat-0:9.0.122-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
                "product": {
                  "name": "tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
                  "product_id": "tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.122:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-jsp-2_3-api@9.0.122-160000.1.1?arch=noarch\u0026upstream=tomcat-0:9.0.122-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
                "product": {
                  "name": "tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
                  "product_id": "tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.122:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-jsvc@9.0.122-160000.1.1?arch=noarch\u0026upstream=tomcat-0:9.0.122-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-0:9.0.122-160000.1.1.noarch",
                "product": {
                  "name": "tomcat-lib-0:9.0.122-160000.1.1.noarch",
                  "product_id": "tomcat-lib-0:9.0.122-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.122:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-lib@9.0.122-160000.1.1?arch=noarch\u0026upstream=tomcat-0:9.0.122-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
                "product": {
                  "name": "tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
                  "product_id": "tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.122:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-servlet-4_0-api@9.0.122-160000.1.1?arch=noarch\u0026upstream=tomcat-0:9.0.122-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-0:9.0.122-160000.1.1.noarch",
                "product": {
                  "name": "tomcat-webapps-0:9.0.122-160000.1.1.noarch",
                  "product_id": "tomcat-webapps-0:9.0.122-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:9.0.122:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat-webapps@9.0.122-160000.1.1?arch=noarch\u0026upstream=tomcat-0:9.0.122-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-0:10.1.60-160000.1.1.noarch",
                "product": {
                  "name": "tomcat10-0:10.1.60-160000.1.1.noarch",
                  "product_id": "tomcat10-0:10.1.60-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:10.1.60:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat10@10.1.60-160000.1.1?arch=noarch\u0026upstream=tomcat10-0:10.1.60-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
                "product": {
                  "name": "tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
                  "product_id": "tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:10.1.60:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat10-admin-webapps@10.1.60-160000.1.1?arch=noarch\u0026upstream=tomcat10-0:10.1.60-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-doc-0:10.1.60-160000.1.1.noarch",
                "product": {
                  "name": "tomcat10-doc-0:10.1.60-160000.1.1.noarch",
                  "product_id": "tomcat10-doc-0:10.1.60-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:10.1.60:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat10-doc@10.1.60-160000.1.1?arch=noarch\u0026upstream=tomcat10-0:10.1.60-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
                "product": {
                  "name": "tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
                  "product_id": "tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:10.1.60:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat10-docs-webapp@10.1.60-160000.1.1?arch=noarch\u0026upstream=tomcat10-0:10.1.60-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
                "product": {
                  "name": "tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
                  "product_id": "tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:10.1.60:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat10-el-5_0-api@10.1.60-160000.1.1?arch=noarch\u0026upstream=tomcat10-0:10.1.60-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-embed-0:10.1.60-160000.1.1.noarch",
                "product": {
                  "name": "tomcat10-embed-0:10.1.60-160000.1.1.noarch",
                  "product_id": "tomcat10-embed-0:10.1.60-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:10.1.60:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat10-embed@10.1.60-160000.1.1?arch=noarch\u0026upstream=tomcat10-0:10.1.60-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
                "product": {
                  "name": "tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
                  "product_id": "tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:10.1.60:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat10-jsp-3_1-api@10.1.60-160000.1.1?arch=noarch\u0026upstream=tomcat10-0:10.1.60-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
                "product": {
                  "name": "tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
                  "product_id": "tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:10.1.60:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat10-jsvc@10.1.60-160000.1.1?arch=noarch\u0026upstream=tomcat10-0:10.1.60-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-lib-0:10.1.60-160000.1.1.noarch",
                "product": {
                  "name": "tomcat10-lib-0:10.1.60-160000.1.1.noarch",
                  "product_id": "tomcat10-lib-0:10.1.60-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:10.1.60:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat10-lib@10.1.60-160000.1.1?arch=noarch\u0026upstream=tomcat10-0:10.1.60-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
                "product": {
                  "name": "tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
                  "product_id": "tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:10.1.60:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat10-servlet-6_0-api@10.1.60-160000.1.1?arch=noarch\u0026upstream=tomcat10-0:10.1.60-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
                "product": {
                  "name": "tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
                  "product_id": "tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:10.1.60:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat10-webapps@10.1.60-160000.1.1?arch=noarch\u0026upstream=tomcat10-0:10.1.60-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-0:11.0.26-160000.1.1.noarch",
                "product": {
                  "name": "tomcat11-0:11.0.26-160000.1.1.noarch",
                  "product_id": "tomcat11-0:11.0.26-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:11.0.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat11@11.0.26-160000.1.1?arch=noarch\u0026upstream=tomcat11-0:11.0.26-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
                "product": {
                  "name": "tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
                  "product_id": "tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:11.0.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat11-admin-webapps@11.0.26-160000.1.1?arch=noarch\u0026upstream=tomcat11-0:11.0.26-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-doc-0:11.0.26-160000.1.1.noarch",
                "product": {
                  "name": "tomcat11-doc-0:11.0.26-160000.1.1.noarch",
                  "product_id": "tomcat11-doc-0:11.0.26-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:11.0.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat11-doc@11.0.26-160000.1.1?arch=noarch\u0026upstream=tomcat11-0:11.0.26-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
                "product": {
                  "name": "tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
                  "product_id": "tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:11.0.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat11-docs-webapp@11.0.26-160000.1.1?arch=noarch\u0026upstream=tomcat11-0:11.0.26-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
                "product": {
                  "name": "tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
                  "product_id": "tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:11.0.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat11-el-6_0-api@11.0.26-160000.1.1?arch=noarch\u0026upstream=tomcat11-0:11.0.26-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-embed-0:11.0.26-160000.1.1.noarch",
                "product": {
                  "name": "tomcat11-embed-0:11.0.26-160000.1.1.noarch",
                  "product_id": "tomcat11-embed-0:11.0.26-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:11.0.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat11-embed@11.0.26-160000.1.1?arch=noarch\u0026upstream=tomcat11-0:11.0.26-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
                "product": {
                  "name": "tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
                  "product_id": "tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:11.0.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat11-jsp-4_0-api@11.0.26-160000.1.1?arch=noarch\u0026upstream=tomcat11-0:11.0.26-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
                "product": {
                  "name": "tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
                  "product_id": "tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:11.0.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat11-jsvc@11.0.26-160000.1.1?arch=noarch\u0026upstream=tomcat11-0:11.0.26-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-lib-0:11.0.26-160000.1.1.noarch",
                "product": {
                  "name": "tomcat11-lib-0:11.0.26-160000.1.1.noarch",
                  "product_id": "tomcat11-lib-0:11.0.26-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:11.0.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat11-lib@11.0.26-160000.1.1?arch=noarch\u0026upstream=tomcat11-0:11.0.26-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
                "product": {
                  "name": "tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
                  "product_id": "tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:11.0.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat11-servlet-6_1-api@11.0.26-160000.1.1?arch=noarch\u0026upstream=tomcat11-0:11.0.26-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-webapps-0:11.0.26-160000.1.1.noarch",
                "product": {
                  "name": "tomcat11-webapps-0:11.0.26-160000.1.1.noarch",
                  "product_id": "tomcat11-webapps-0:11.0.26-160000.1.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:apache:tomcat:11.0.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tomcat11-webapps@11.0.26-160000.1.1?arch=noarch\u0026upstream=tomcat11-0:11.0.26-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
                "product": {
                  "name": "libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
                  "product_id": "libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-1-0@1.3.9-160000.1.1?arch=ppc64le\u0026upstream=libtcnative-1-0-0:1.3.9-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
                "product": {
                  "name": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
                  "product_id": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-1-0-devel@1.3.9-160000.1.1?arch=ppc64le\u0026upstream=libtcnative-1-0-0:1.3.9-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
                "product": {
                  "name": "libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
                  "product_id": "libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-2-0@2.0.16-160000.1.1?arch=ppc64le\u0026upstream=libtcnative-2-0-0:2.0.16-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
                "product": {
                  "name": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
                  "product_id": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-2-0-devel@2.0.16-160000.1.1?arch=ppc64le\u0026upstream=libtcnative-2-0-0:2.0.16-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
                "product": {
                  "name": "libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
                  "product_id": "libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-1-0@1.3.9-160000.1.1?arch=s390x\u0026upstream=libtcnative-1-0-0:1.3.9-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
                "product": {
                  "name": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
                  "product_id": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-1-0-devel@1.3.9-160000.1.1?arch=s390x\u0026upstream=libtcnative-1-0-0:1.3.9-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
                "product": {
                  "name": "libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
                  "product_id": "libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-2-0@2.0.16-160000.1.1?arch=s390x\u0026upstream=libtcnative-2-0-0:2.0.16-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
                "product": {
                  "name": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
                  "product_id": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-2-0-devel@2.0.16-160000.1.1?arch=s390x\u0026upstream=libtcnative-2-0-0:2.0.16-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
                "product": {
                  "name": "libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
                  "product_id": "libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-1-0@1.3.9-160000.1.1?arch=x86_64\u0026upstream=libtcnative-1-0-0:1.3.9-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
                "product": {
                  "name": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
                  "product_id": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-1-0-devel@1.3.9-160000.1.1?arch=x86_64\u0026upstream=libtcnative-1-0-0:1.3.9-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
                "product": {
                  "name": "libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
                  "product_id": "libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-2-0@2.0.16-160000.1.1?arch=x86_64\u0026upstream=libtcnative-2-0-0:2.0.16-160000.1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
                "product": {
                  "name": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
                  "product_id": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/libtcnative-2-0-devel@2.0.16-160000.1.1?arch=x86_64\u0026upstream=libtcnative-2-0-0:2.0.16-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-1-0-0:1.3.9-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64"
        },
        "product_reference": "libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le"
        },
        "product_reference": "libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-1-0-0:1.3.9-160000.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x"
        },
        "product_reference": "libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-1-0-0:1.3.9-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64"
        },
        "product_reference": "libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64"
        },
        "product_reference": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le"
        },
        "product_reference": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x"
        },
        "product_reference": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64"
        },
        "product_reference": "libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-2-0-0:2.0.16-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64"
        },
        "product_reference": "libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le"
        },
        "product_reference": "libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-2-0-0:2.0.16-160000.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x"
        },
        "product_reference": "libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-2-0-0:2.0.16-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64"
        },
        "product_reference": "libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64"
        },
        "product_reference": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le"
        },
        "product_reference": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x"
        },
        "product_reference": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64"
        },
        "product_reference": "libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-0:9.0.122-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch"
        },
        "product_reference": "tomcat-0:9.0.122-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch"
        },
        "product_reference": "tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-embed-0:9.0.122-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch"
        },
        "product_reference": "tomcat-embed-0:9.0.122-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-0:9.0.122-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch"
        },
        "product_reference": "tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsvc-0:9.0.122-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch"
        },
        "product_reference": "tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-0:9.0.122-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch"
        },
        "product_reference": "tomcat-lib-0:9.0.122-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-0:9.0.122-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch"
        },
        "product_reference": "tomcat-webapps-0:9.0.122-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-0:10.1.60-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch"
        },
        "product_reference": "tomcat10-0:10.1.60-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch"
        },
        "product_reference": "tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-doc-0:10.1.60-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch"
        },
        "product_reference": "tomcat10-doc-0:10.1.60-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch"
        },
        "product_reference": "tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch"
        },
        "product_reference": "tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-embed-0:10.1.60-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch"
        },
        "product_reference": "tomcat10-embed-0:10.1.60-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch"
        },
        "product_reference": "tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-jsvc-0:10.1.60-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch"
        },
        "product_reference": "tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-lib-0:10.1.60-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch"
        },
        "product_reference": "tomcat10-lib-0:10.1.60-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch"
        },
        "product_reference": "tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-webapps-0:10.1.60-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch"
        },
        "product_reference": "tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-0:11.0.26-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch"
        },
        "product_reference": "tomcat11-0:11.0.26-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch"
        },
        "product_reference": "tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-doc-0:11.0.26-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch"
        },
        "product_reference": "tomcat11-doc-0:11.0.26-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch"
        },
        "product_reference": "tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch"
        },
        "product_reference": "tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-embed-0:11.0.26-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch"
        },
        "product_reference": "tomcat11-embed-0:11.0.26-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch"
        },
        "product_reference": "tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-jsvc-0:11.0.26-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch"
        },
        "product_reference": "tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-lib-0:11.0.26-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch"
        },
        "product_reference": "tomcat11-lib-0:11.0.26-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch"
        },
        "product_reference": "tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-webapps-0:11.0.26-160000.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        },
        "product_reference": "tomcat11-webapps-0:11.0.26-160000.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-73581",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-73581"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100.  Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-73581",
          "url": "https://www.suse.com/security/cve/CVE-2026-73581"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282631 for CVE-2026-73581",
          "url": "https://bugzilla.suse.com/1282631"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-73581"
    },
    {
      "cve": "CVE-2026-75973",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-75973"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-75973",
          "url": "https://www.suse.com/security/cve/CVE-2026-75973"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282630 for CVE-2026-75973",
          "url": "https://bugzilla.suse.com/1282630"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-75973"
    },
    {
      "cve": "CVE-2026-76183",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-76183"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOS at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-76183",
          "url": "https://www.suse.com/security/cve/CVE-2026-76183"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282629 for CVE-2026-76183",
          "url": "https://bugzilla.suse.com/1282629"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-76183"
    },
    {
      "cve": "CVE-2026-77756",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-77756"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-77756",
          "url": "https://www.suse.com/security/cve/CVE-2026-77756"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282628 for CVE-2026-77756",
          "url": "https://bugzilla.suse.com/1282628"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-77756"
    },
    {
      "cve": "CVE-2026-77762",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-77762"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix  the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-77762",
          "url": "https://www.suse.com/security/cve/CVE-2026-77762"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282599 for CVE-2026-77762",
          "url": "https://bugzilla.suse.com/1282599"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-77762"
    },
    {
      "cve": "CVE-2026-77791",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-77791"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.88 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-77791",
          "url": "https://www.suse.com/security/cve/CVE-2026-77791"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282627 for CVE-2026-77791",
          "url": "https://bugzilla.suse.com/1282627"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-77791"
    },
    {
      "cve": "CVE-2026-78383",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-78383"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-78383",
          "url": "https://www.suse.com/security/cve/CVE-2026-78383"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282626 for CVE-2026-78383",
          "url": "https://bugzilla.suse.com/1282626"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-78383"
    },
    {
      "cve": "CVE-2026-78437",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-78437"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-78437",
          "url": "https://www.suse.com/security/cve/CVE-2026-78437"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282625 for CVE-2026-78437",
          "url": "https://bugzilla.suse.com/1282625"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-78437"
    },
    {
      "cve": "CVE-2026-79677",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-79677"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109.  Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-79677",
          "url": "https://www.suse.com/security/cve/CVE-2026-79677"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282624 for CVE-2026-79677",
          "url": "https://bugzilla.suse.com/1282624"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-79677"
    },
    {
      "cve": "CVE-2026-86243",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-86243"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.\n\n\n\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-86243",
          "url": "https://www.suse.com/security/cve/CVE-2026-86243"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282623 for CVE-2026-86243",
          "url": "https://bugzilla.suse.com/1282623"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-86243"
    },
    {
      "cve": "CVE-2026-86246",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-86246"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options  by default  including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.\n\n\n\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-86246",
          "url": "https://www.suse.com/security/cve/CVE-2026-86246"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282622 for CVE-2026-86246",
          "url": "https://bugzilla.suse.com/1282622"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-86246"
    },
    {
      "cve": "CVE-2026-86247",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-86247"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.\n\n\n\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-86247",
          "url": "https://www.suse.com/security/cve/CVE-2026-86247"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282621 for CVE-2026-86247",
          "url": "https://bugzilla.suse.com/1282621"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-86247"
    },
    {
      "cve": "CVE-2026-86248",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-86248"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-86248",
          "url": "https://www.suse.com/security/cve/CVE-2026-86248"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282620 for CVE-2026-86248",
          "url": "https://bugzilla.suse.com/1282620"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-86248"
    },
    {
      "cve": "CVE-2026-86350",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-86350"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Inconsistent interpretation of HTTP/2 requests (\u0027HTTP Request/Response smuggling\u0027) vulnerability in Apache Tomcat caused by a  regression in fix for CVE-2026-41293 can trigger request header mix-up.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-86350",
          "url": "https://www.suse.com/security/cve/CVE-2026-86350"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265163 for CVE-2026-86350",
          "url": "https://bugzilla.suse.com/1265163"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282787 for CVE-2026-86350",
          "url": "https://bugzilla.suse.com/1282787"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-86350"
    },
    {
      "cve": "CVE-2026-87022",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-87022"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOS at the time the CVE was created but are known to be affected:  from 8.5.0 through 8.5.100, from 7.0.56 through 7.0.109.  Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
          "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
          "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
          "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-87022",
          "url": "https://www.suse.com/security/cve/CVE-2026-87022"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282581 for CVE-2026-87022",
          "url": "https://bugzilla.suse.com/1282581"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-1-0-devel-0:1.3.9-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.aarch64",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.ppc64le",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.s390x",
            "openSUSE Leap 16.0:libtcnative-2-0-devel-0:2.0.16-160000.1.1.x86_64",
            "openSUSE Leap 16.0:tomcat-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-admin-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-docs-webapp-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-el-3_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-embed-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-javadoc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsp-2_3-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-jsvc-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-lib-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-servlet-4_0-api-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat-webapps-0:9.0.122-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-admin-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-doc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-docs-webapp-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-el-5_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-embed-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsp-3_1-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-jsvc-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-lib-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-servlet-6_0-api-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat10-webapps-0:10.1.60-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-admin-webapps-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-doc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-docs-webapp-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-el-6_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-embed-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsp-4_0-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-jsvc-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-lib-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-servlet-6_1-api-0:11.0.26-160000.1.1.noarch",
            "openSUSE Leap 16.0:tomcat11-webapps-0:11.0.26-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-30T17:58:26Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-87022"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.