The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1604-1 advisory.

    Security fixes:

    - CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
    - CVE-2026-25854: Occasionally open redirect (bsc#1261851).
    - CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
    - CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
    - CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
    - CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
    - CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token     (bsc#1261856).
    - CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
    - CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

    Other fixes:

    - Update to Tomcat 9.0.117

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6328 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6328-1                   security@debian.org     https://www.debian.org/security/                          Markus Koschany     June 08, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : tomcat10     CVE ID         : CVE-2026-24880 CVE-2026-25854 CVE-2026-29129 CVE-2026-29145                      CVE-2026-29146 CVE-2026-32990 CVE-2026-34483 CVE-2026-34487                      CVE-2026-34500 CVE-2026-41284 CVE-2026-41293 CVE-2026-42498                      CVE-2026-43512 CVE-2026-43513 CVE-2026-43514 CVE-2026-43515

    Multiple security vulnerabilities have been discovered in Tomcat 10, a Java     based web server, servlet and JSP engine which may result in a denial of     service, authentication bypass or the disclosure of sensitive information.

    Although we are not aware of any problems, new upstream versions may introduce     new options, limits or code changes which may or may not affect your existing     web applications. We recommend to consult the Tomcat 10 documentation for     further information.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 10.1.55-1~deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 10.1.55-1~deb13u1.

    We recommend that you upgrade your tomcat10 packages.

    For the detailed security status of tomcat10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tomcat10

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20595-1 advisory.

    - Update to Tomcat 11.0.21
    - CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
    - CVE-2026-25854: Occasionally open redirect (bsc#1261851).
    - CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
    - CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
    - CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
    - CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
    - CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token     (bsc#1261856).
    - CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
    - CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1603-1 advisory.

    Security fixes:

    - CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
    - CVE-2026-25854: Occasionally open redirect (bsc#1261851).
    - CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
    - CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
    - CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
    - CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
    - CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token     (bsc#1261856).
    - CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
    - CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

    Other fixes:

    - Update to Tomcat 10.1.54

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_25341 advisory.

    * tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation     (CVE-2026-24734)

    * tomcat: Client certificate verification bypass due to virtual host mapping (CVE-2025-66614)

    * tomcat: security constraint bypass with HTTP/0.9 (CVE-2026-24733)

    * Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration     (CVE-2026-29145)

    * Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files (CVE-2026-34487)

    * Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve (CVE-2026-25854)

    * Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension     (CVE-2026-24880)

    * Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration     (CVE-2026-34500)

    * Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve     (CVE-2026-34483)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
310238	SUSE SLES15 Security Update : tomcat (SUSE-SU-2026:1604-1)	Nessus	SuSE Local Security Checks	2026/4/25	2026/8/4	high
319682	Debian dsa-6328 : libtomcat10-embed-java - security update	Nessus	Debian Local Security Checks	2026/6/8	2026/6/8	high
309888	openSUSE 16 Security Update : tomcat11 (openSUSE-SU-2026:20595-1)	Nessus	SuSE Local Security Checks	2026/4/23	2026/8/4	high
310234	SUSE SLES15 Security Update : tomcat10 (SUSE-SU-2026:1603-1)	Nessus	SuSE Local Security Checks	2026/4/25	2026/8/4	high
359538	Rocky Linux 10.2 [CIQ] Security Update: tomcat9 / tomcat9-admin-webapps / tomcat9-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_25341)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium

检测

插件搜索

high

high

high

high

medium