Vulnerability-Lookup

RHSA-2026:92863

Vulnerability from csaf_redhat - Published: 2026-10-29 22:17 - Updated: 2026-11-02 10:51

Summary

Red Hat Security Advisory: tomcat security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for tomcat is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569) * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905) * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525) * tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763) Bug Fix(es) and Enhancement(s): * Stalled TLS handshake when the server's first flight is too large [rhel-10.0] (JIRA:RHEL-279019) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-65182

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potentially leading to unauthorized access to resources.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Affected products

Fixed 9 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-65905

A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This allows the attacker to replay the request once, potentially bypassing authentication.

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-294 - Authentication Bypass by Capture-replay

Affected products

Fixed 9 products, the same list as for CVE-2026-65182

Threats

Impact Moderate

CVE-2026-65927

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's [N] flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE-193 - Off-by-one Error

Affected products

Fixed 9 products, the same list as for CVE-2026-65182

Threats

Impact Important

CVE-2026-68525

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be restricted to POST requests only.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Affected products

Fixed 9 products, the same list as for CVE-2026-65182

Threats

Impact Moderate

CVE-2026-68569

A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized access to the system.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE-305 - Authentication Bypass by Primary Weakness

Affected products

Fixed 9 products, the same list as for CVE-2026-65182

Threats

Impact Important

CVE-2026-68763

A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service (DoS), making the server unresponsive or unavailable to users.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 9 products, the same list as for CVE-2026-65182

Threats

Impact Important

References

40 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:92863	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2524151	external
https://bugzilla.redhat.com/show_bug.cgi?id=2524154	external
https://bugzilla.redhat.com/show_bug.cgi?id=2524160	external
https://bugzilla.redhat.com/show_bug.cgi?id=2524161	external
https://bugzilla.redhat.com/show_bug.cgi?id=2524162	external
https://bugzilla.redhat.com/show_bug.cgi?id=2524166	external
https://issues.redhat.com/browse/RHEL-279019	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-65182	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524151	external
https://www.cve.org/CVERecord?id=CVE-2026-65182	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65182	external
https://lists.apache.org/thread/joosxvzc9b49ttj8l…	external
https://access.redhat.com/security/cve/CVE-2026-65905	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524161	external
https://www.cve.org/CVERecord?id=CVE-2026-65905	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65905	external
https://lists.apache.org/thread/9v114xlpgbzrrbzz5…	external
https://access.redhat.com/security/cve/CVE-2026-65927	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524154	external
https://www.cve.org/CVERecord?id=CVE-2026-65927	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65927	external
https://lists.apache.org/thread/st1dx1zyn5y7ny2s0…	external
https://access.redhat.com/security/cve/CVE-2026-68525	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524162	external
https://www.cve.org/CVERecord?id=CVE-2026-68525	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68525	external
https://lists.apache.org/thread/x1y2lfsgzxwzc456f…	external
https://access.redhat.com/security/cve/CVE-2026-68569	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524160	external
https://www.cve.org/CVERecord?id=CVE-2026-68569	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68569	external
https://lists.apache.org/thread/8robqo76q0osxgw0b…	external
https://access.redhat.com/security/cve/CVE-2026-68763	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524166	external
https://www.cve.org/CVERecord?id=CVE-2026-68763	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68763	external
https://lists.apache.org/thread/tv51ty39ppv41v04h…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for tomcat is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)\n\n* tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)\n\n* tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)\n\n* tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905)\n\n* tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)\n\n* tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)\n\nBug Fix(es) and Enhancement(s):\n\n* Stalled TLS handshake when the server\u0027s first flight is too large [rhel-10.0] (JIRA:RHEL-279019)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:92863",
        "url": "https://access.redhat.com/errata/RHSA-2026:92863"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2524151",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524151"
      },
      {
        "category": "external",
        "summary": "2524154",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524154"
      },
      {
        "category": "external",
        "summary": "2524160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524160"
      },
      {
        "category": "external",
        "summary": "2524161",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524161"
      },
      {
        "category": "external",
        "summary": "2524162",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524162"
      },
      {
        "category": "external",
        "summary": "2524166",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524166"
      },
      {
        "category": "external",
        "summary": "RHEL-279019",
        "url": "https://issues.redhat.com/browse/RHEL-279019"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92863.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2026-11-02T10:51:50+00:00",
      "generator": {
        "date": "2026-11-02T10:51:50+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:92863",
      "initial_release_date": "2026-10-29T22:17:02+00:00",
      "revision_history": [
        {
          "date": "2026-10-29T22:17:02+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-29T22:17:02+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-02T10:51:50+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                  "product_id": "AppStream-10.0.Z.E2S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-1:10.1.49-2.el10_0.src",
                "product": {
                  "name": "tomcat-1:10.1.49-2.el10_0.src",
                  "product_id": "tomcat-1:10.1.49-2.el10_0.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat@10.1.49-2.el10_0?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-1:10.1.49-2.el10_0.noarch",
                "product": {
                  "name": "tomcat-1:10.1.49-2.el10_0.noarch",
                  "product_id": "tomcat-1:10.1.49-2.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat@10.1.49-2.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
                "product": {
                  "name": "tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
                  "product_id": "tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-admin-webapps@10.1.49-2.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
                "product": {
                  "name": "tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
                  "product_id": "tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-docs-webapp@10.1.49-2.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
                "product": {
                  "name": "tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
                  "product_id": "tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-el-5.0-api@10.1.49-2.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
                "product": {
                  "name": "tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
                  "product_id": "tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-jsp-3.1-api@10.1.49-2.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-1:10.1.49-2.el10_0.noarch",
                "product": {
                  "name": "tomcat-lib-1:10.1.49-2.el10_0.noarch",
                  "product_id": "tomcat-lib-1:10.1.49-2.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-lib@10.1.49-2.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
                "product": {
                  "name": "tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
                  "product_id": "tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-servlet-6.0-api@10.1.49-2.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-1:10.1.49-2.el10_0.noarch",
                "product": {
                  "name": "tomcat-webapps-1:10.1.49-2.el10_0.noarch",
                  "product_id": "tomcat-webapps-1:10.1.49-2.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-webapps@10.1.49-2.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-1:10.1.49-2.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch"
        },
        "product_reference": "tomcat-1:10.1.49-2.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-1:10.1.49-2.el10_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src"
        },
        "product_reference": "tomcat-1:10.1.49-2.el10_0.src",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch"
        },
        "product_reference": "tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch"
        },
        "product_reference": "tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch"
        },
        "product_reference": "tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch"
        },
        "product_reference": "tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-1:10.1.49-2.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch"
        },
        "product_reference": "tomcat-lib-1:10.1.49-2.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch"
        },
        "product_reference": "tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-1:10.1.49-2.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
        },
        "product_reference": "tomcat-webapps-1:10.1.49-2.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-65182",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-08-25T22:01:20.312934+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524151"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potentially leading to unauthorized access to resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Apache Tomcat allows for security constraint bypasses, potentially granting unauthorized access to protected web application resources. The flaw occurs when security constraints for longer URL paths are defined before more restrictive constraints for shorter, specific sub-paths within the application\u0027s `web.xml` configuration. This misconfiguration can undermine intended access controls in Red Hat deployments of Apache Tomcat.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
          "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65182"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524151",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524151"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65182",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65182"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65182",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65182"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m",
          "url": "https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m"
        }
      ],
      "release_date": "2026-08-25T21:43:37.040000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T22:17:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92863"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that security constraints in Apache Tomcat\u0027s web.xml configuration files are ordered from most specific to least specific. More restrictive constraints for shorter sub-paths must be defined before broader constraints for longer paths. Incorrect ordering can lead to a bypass of intended access controls. After modifying web.xml, a restart or reload of the Apache Tomcat service is required for the changes to take effect, which may temporarily interrupt service availability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control"
    },
    {
      "cve": "CVE-2026-65905",
      "cwe": {
        "id": "CWE-294",
        "name": "Authentication Bypass by Capture-replay"
      },
      "discovery_date": "2026-08-25T22:02:01.496501+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524161"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This allows the attacker to replay the request once, potentially bypassing authentication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Apache Tomcat\u0027s DIGEST authenticator allows a limited authentication bypass through a replay attack. While the attack complexity is high, a remote attacker could potentially replay a single authenticated request if the nonceCount is at the upper boundary of the replay window, leading to limited unauthorized access. This vulnerability affects configurations utilizing DIGEST authentication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
          "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65905"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524161",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524161"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65905",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65905"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65905",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65905"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj",
          "url": "https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj"
        }
      ],
      "release_date": "2026-08-25T21:51:33.307000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T22:17:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92863"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable DIGEST authentication in Apache Tomcat if it is not a required authentication mechanism for your deployment. Refer to the Apache Tomcat documentation for guidance on configuring authentication methods. Disabling DIGEST authentication will affect services that depend on it. A restart of the Tomcat service is necessary for the configuration changes to be applied.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator"
    },
    {
      "cve": "CVE-2026-65927",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "discovery_date": "2026-08-25T22:01:39.117949+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve\u0027s [N] flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Apache Tomcat due to an off-by-one error in the RewriteValve\u0027s [N] flag processing. This vulnerability can lead to an access control bypass, allowing unauthorized access to resources in applications that utilize the RewriteValve with the [N] flag.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
          "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65927"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65927",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65927"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65927",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65927"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4",
          "url": "https://lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4"
        }
      ],
      "release_date": "2026-08-25T21:53:05.852000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T22:17:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92863"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing"
    },
    {
      "cve": "CVE-2026-68525",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-08-25T22:02:06.162838+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524162"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be restricted to POST requests only.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact vulnerability in Apache Tomcat\u0027s FORM authentication process, as utilized in Red Hat JBoss Web Server, allows an attacker to bypass security constraints for POST requests. This enables unauthorized access to resources that are configured to restrict POST access while permitting GET, potentially leading to unintended data exposure or manipulation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
          "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68525"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524162",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524162"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68525",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68525"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68525",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68525"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7",
          "url": "https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7"
        }
      ],
      "release_date": "2026-08-25T21:57:18.557000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T22:17:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92863"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass"
    },
    {
      "cve": "CVE-2026-68569",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "discovery_date": "2026-08-25T22:01:58.059796+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This improper authentication vulnerability allows a remote attacker to be authenticated even if their user account does not exist in the DataSourceRealm, under specific circumstances such as CLIENT-CERT or SPNEGO authentication. This can lead to unauthorized access to the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Apache Tomcat allows unauthorized access when configured with CLIENT-CERT or SPNEGO authentication alongside a DataSourceRealm. This flaw could permit a user to be authenticated even if their account does not exist, bypassing intended security controls in Red Hat deployments where these specific configurations are in use.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
          "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68569"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68569",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68569"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68569",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68569"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc",
          "url": "https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc"
        }
      ],
      "release_date": "2026-08-25T21:59:17.438000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T22:17:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92863"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid using CLIENT-CERT or SPNEGO authentication methods with the DataSourceRealm in Apache Tomcat. Alternatively, restrict network access to the Apache Tomcat instance to trusted clients only, thereby limiting exposure to potential attackers. If changes are made to the Tomcat configuration, a service restart may be required for the changes to take effect.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure"
    },
    {
      "cve": "CVE-2026-68763",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-25T22:10:59.055803+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524166"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service (DoS), making the server unresponsive or unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Apache Tomcat, as shipped with Red Hat JBoss Web Server, allows a remote, unauthenticated attacker to cause a denial of service. The vulnerability stems from an allocation leak in the HTTP/2 backlog tracking, which can be triggered by resetting an HTTP/2 stream, leading to resource exhaustion and service unavailability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
          "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
          "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68763"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524166",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524166"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68763",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68763"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68763",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68763"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/tv51ty39ppv41v04hdtkp9dp7tg02nzl",
          "url": "https://lists.apache.org/thread/tv51ty39ppv41v04hdtkp9dp7tg02nzl"
        }
      ],
      "release_date": "2026-08-25T22:00:37.047000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T22:17:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92863"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, disable the HTTP/2 protocol in Apache Tomcat if it is not required for your deployment. This can be achieved by commenting out or removing the \u003cUpgradeProtocol className=\"org.apache.coyote.http2.Http2Protocol\" /\u003e element within the \u003cConnector\u003e configuration in the server.xml file. After modifying server.xml, a restart of the Apache Tomcat service is required for the changes to take effect.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-1:10.1.49-2.el10_0.src",
            "AppStream-10.0.Z.E2S:tomcat-admin-webapps-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-docs-webapp-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-el-5.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-jsp-3.1-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-lib-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-servlet-6.0-api-1:10.1.49-2.el10_0.noarch",
            "AppStream-10.0.Z.E2S:tomcat-webapps-1:10.1.49-2.el10_0.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak"
    }
  ]
}

CVE-2026-65182 (GCVE-0-2026-65182)

Vulnerability from cvelistv5 – Published: 2026-08-25 21:43 – Updated: 2026-08-26 15:18

Title

Apache Tomcat: Bypass longest prefix security constraint

Summary

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 15:17 UTC

CWE

CWE-284 - Improper Access Control
CWE-863 - Incorrect Authorization

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1170 records in the last 180 days details

References

2 references

URL	Tags
https://lists.apache.org/thread/joosxvzc9b49ttj8l…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/08/26/1

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.24 (semver) Affected: 10.1.0-M1 , ≤ 10.1.57 (semver) Affected: 9.0.0.M1 , ≤ 9.0.120 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Affected: 7.0.0 , ≤ 7.0.109 (semver) Unknown: 0 , < 7.0.0 (semver)

Credits

4ra1n, pyn3rd and unam4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-26T02:30:35.125Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/26/1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-65182",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:17:14.686440Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T15:18:16.813Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.24",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.57",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.120",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "4ra1n, pyn3rd and unam4"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T21:43:37.040Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Bypass longest prefix security constraint",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-65182",
    "datePublished": "2026-08-25T21:43:37.040Z",
    "dateReserved": "2026-07-21T18:33:56.118Z",
    "dateUpdated": "2026-08-26T15:18:16.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-65905 (GCVE-0-2026-65905)

Vulnerability from cvelistv5 – Published: 2026-08-25 21:51 – Updated: 2026-08-26 15:21

Title

Apache Tomcat: Limited replay attack possible with DIGEST authentication

Summary

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 15:20 UTC

CWE

CWE-294 - Authentication Bypass by Capture-replay

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1170 records in the last 180 days details

References

2 references

URL	Tags
https://lists.apache.org/thread/9v114xlpgbzrrbzz5…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/08/26/4

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.24 (semver) Affected: 10.1.0-M1 , ≤ 10.1.57 (semver) Affected: 9.0.0.M1 , ≤ 9.0.120 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Affected: 7.0.30 , ≤ 7.0.109 (semver)

Credits

4ra1n, pyn3rd and unam4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-26T02:30:37.048Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/26/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-65905",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:20:56.087834Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T15:21:11.604Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.24",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.57",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.120",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.30",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "4ra1n, pyn3rd and unam4"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAuthentication Bypass by Capture-replay vulnerability in Apache Tomcat\u0027s DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST \nauthenticated request with a nonceCount on the upper boundary of the \nreplay window then that request is replayable once only while the \nassociated nonceCount remains within the replay window.\u003c/p\u003e\u003cp\u003e\u0026nbsp;\n\u003cbr\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\u003c/p\u003e\u003cp\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected:\u0026nbsp;from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Authentication Bypass by Capture-replay vulnerability in Apache Tomcat\u0027s DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST \nauthenticated request with a nonceCount on the upper boundary of the \nreplay window then that request is replayable once only while the \nassociated nonceCount remains within the replay window.\n\n\n\n\u00a0\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected:\u00a0from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-294",
              "description": "CWE-294 Authentication Bypass by Capture-replay",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T21:51:33.307Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Limited replay attack possible with DIGEST authentication",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-65905",
    "datePublished": "2026-08-25T21:51:33.307Z",
    "dateReserved": "2026-07-23T12:14:17.351Z",
    "dateUpdated": "2026-08-26T15:21:11.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-65927 (GCVE-0-2026-65927)

Vulnerability from cvelistv5 – Published: 2026-08-25 21:53 – Updated: 2026-08-26 15:22

Title

Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

Summary

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 15:21 UTC

CWE

CWE-193 - Off-by-one Error

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1170 records in the last 180 days details

References

2 references

URL	Tags
https://lists.apache.org/thread/st1dx1zyn5y7ny2s0…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/08/26/5

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.24 (semver) Affected: 10.1.0-M1 , ≤ 10.1.57 (semver) Affected: 9.0.0.M1 , ≤ 9.0.120 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Unaffected: 7.0.0 , ≤ 7.0.109 (semver) Unaffected: 0 , < 7.0.0 (semver)

Credits

4ra1n, pyn3rd and unam4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-26T02:30:38.001Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/26/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-65927",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:21:40.924718Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T15:22:01.843Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.24",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.57",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.120",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "unaffected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "4ra1n, pyn3rd and unam4"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOff-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\u003c/p\u003e\u003cp\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-193",
              "description": "CWE-193 Off-by-one Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T21:53:05.852Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-65927",
    "datePublished": "2026-08-25T21:53:05.852Z",
    "dateReserved": "2026-07-23T14:24:12.608Z",
    "dateUpdated": "2026-08-26T15:22:01.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68525 (GCVE-0-2026-68525)

Vulnerability from cvelistv5 – Published: 2026-08-25 21:57 – Updated: 2026-08-26 18:40

Title

Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

Summary

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 18:40 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1170 records in the last 180 days details

References

2 references

URL	Tags
https://lists.apache.org/thread/x1y2lfsgzxwzc456f…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/08/26/7

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.24 (semver) Affected: 10.1.0-M1 , ≤ 10.1.57 (semver) Affected: 9.0.0.M1 , ≤ 9.0.120 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Affected: 7.0.0 , ≤ 7.0.109 (semver) Unknown: 0 , < 7.0.0 (semver)

Credits

4ra1n, pyn3rd and unam4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-26T02:30:39.898Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/26/7"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-68525",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:40:39.554877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T18:40:55.312Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.24",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.57",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.120",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "4ra1n, pyn3rd and unam4"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIncorrect Authorization vulnerability in Apache Tomcat\u0027s FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect Authorization vulnerability in Apache Tomcat\u0027s FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T21:57:18.557Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Redirect after FORM auth may bypass method specific constraints",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-68525",
    "datePublished": "2026-08-25T21:57:18.557Z",
    "dateReserved": "2026-07-30T16:56:11.472Z",
    "dateUpdated": "2026-08-26T18:40:55.312Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68569 (GCVE-0-2026-68569)

Vulnerability from cvelistv5 – Published: 2026-08-25 21:59 – Updated: 2026-09-21 11:06

Title

Apache Tomcat: Principal lookup can fail open in some cases

Summary

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 18:38 UTC

CWE

CWE-287 - Improper Authentication

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1170 records in the last 180 days details

References

2 references

URL	Tags
https://lists.apache.org/thread/8robqo76q0osxgw0b…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/08/26/8

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.24 (semver) Affected: 10.1.0-M1 , ≤ 10.1.57 (semver) Affected: 9.0.0.M1 , ≤ 9.0.120 (semver) Affected: 8.5.0 , ≤ 8.5.100 (semver) Affected: 7.0.0 , ≤ 7.0.109 (semver) Unknown: 0 , < 7.0.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-26T02:30:40.822Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/26/8"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-68569",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:38:39.170628Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T18:38:54.931Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.24",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.57",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.120",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T11:06:13.066Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: Principal lookup can fail open in some cases",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-68569",
    "datePublished": "2026-08-25T21:59:17.438Z",
    "dateReserved": "2026-07-31T07:51:47.785Z",
    "dateUpdated": "2026-09-21T11:06:13.066Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68763 (GCVE-0-2026-68763)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:00 – Updated: 2026-08-26 18:36

Title

Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

Summary

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 18:36 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1170 records in the last 180 days details

References

2 references

URL	Tags
https://lists.apache.org/thread/tv51ty39ppv41v04h…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/08/26/9

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Tomcat	Affected: 11.0.0-M1 , ≤ 11.0.24 (semver) Affected: 10.1.0-M1 , ≤ 10.1.57 (semver) Affected: 9.0.39 , ≤ 9.0.120 (semver) Affected: 8.5.59 , ≤ 8.5.100 (semver) Unaffected: 0 , ≤ 7.0.109 (semver)

Credits

Zhen Kong

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-26T02:30:41.764Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/26/9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-68763",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:36:23.912058Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T18:36:43.341Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.24",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.57",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.120",
              "status": "affected",
              "version": "9.0.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.109",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhen Kong"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in Apache Tomcat\u0026nbsp;via an allocation leak in the HTTP/2 backlog tracking when a stream is reset\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.\u003c/p\u003e\u003cp\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.59 through 8.5.100.\u0026nbsp;Other unsupported versions may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat\u00a0via an allocation leak in the HTTP/2 backlog tracking when a stream is reset\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.59 through 8.5.100.\u00a0Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:00:37.047Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/tv51ty39ppv41v04hdtkp9dp7tg02nzl"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-68763",
    "datePublished": "2026-08-25T22:00:37.047Z",
    "dateReserved": "2026-07-31T15:42:11.281Z",
    "dateUpdated": "2026-08-26T18:36:43.341Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:92863

CVE-2026-65182 (GCVE-0-2026-65182)

CVE-2026-65905 (GCVE-0-2026-65905)

CVE-2026-65927 (GCVE-0-2026-65927)

CVE-2026-68525 (GCVE-0-2026-68525)

CVE-2026-68569 (GCVE-0-2026-68569)

CVE-2026-68763 (GCVE-0-2026-68763)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour