The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2299-1 advisory.

    This update for tomcat fixes the following issues

    Update to Tomcat 9.0.118:

    - CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).
    - CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).
    - CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).
    - CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).
    - CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).
    - CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).
    - CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).

    Changes:

     * Catalina      + Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and      OpenSSL version information (both APR and FFM implementations), along with      version compatibility warnings and third-party library version      information. (csutherl)      + Code: Refactor generation of the remote user element in the access log to      remove unnecessary code. (markt)      + Fix: Fix a regression in the previous release that meant ?- could appear      in the access log rather than ? when the query string was present but      empty. (markt)      + Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by      Mahmoud Alarby. (remm)      + Fix: Align the escaping in ExtendedAccessLogValve with the other      AccessLogValve implementations. (markt)      + Fix: 70000: fix duplication of special headers in the response after      commit, following fix for 69967. (remm)      + Fix: Correct the handling of URIs mapped to a security constraint that      only specifies the special ** role for all authenticated users. Requests      without authentication were receiving 403 responses rather than 401      responses. (markt)      + Fix: Fix a race condition in StandardContext.getServletContext() that      could cause the jakarta.servlet.context.tempdir attribute to be lost      during a context reload. Make the context field volatile and use locking      to ensure only one ApplicationContext instance is created. (dsoumis)      + Fix: Update the Windows authentication (kerberos) documentation to reflect      that both Java and Windows are removing / have removed support for      RC4-HMAC. The guide now uses AES256-SHA1. (markt)      + Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize      which limits the size of a WebDAV request body for LOCK and PROPFIND. The      default value is 4096 bytes. (markt)      + Add: Add a new caseSensitive attribute to the LockOutRealm that controls      the manner in which user names are treated when making locking decisions.
     The default is false, meaning user names are treated in a case insensitive      manner. (markt)      + Fix: Correct the handling of invalid users with DIGEST authentication.
     (markt)      + Fix: Ensure RealmBase finds all matching extension based security      constraints. (markt)
     * Coyote      + Fix: Avoid various edge cases if Content-Length is set via      setHeader(String,String) or addHeader(String,String) with an invalid value      by always clearing the previous value whether the new value is valid or      not and ignoring any invalid new value. (markt)      + Code: Refactor the calculation of the real index in the HPACK dynamic      header table implementation to reduce code duplication. (markt)      + Fix: Fix various minor issues with some HTTP/2 stream error messages for      HTTP/2. (markt)      + Fix: Consistently reject URIs containing NULL bytes when normalizing.
     + Fix: Fix a few minor memory leaks on error paths reading TLS keys and      certificates when using FFM. (markt)      + Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC      after a stream reset. (markt)      + Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields      not permitted in trailers. (markt)      + Fix: Free private keys after use in FFM based connector configuration.
     + Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header      decoding that could result in a valid header triggering an unexpected      connection close. (markt)      + Fix: Refactor HTTP/2 HPACK encoding so header field names are only      converted to lower case once during the encoding process. (markt)      + Fix: Refactor HTTP/2 header field validation so it occurs earlier. Extend      validation to check for disallowed characters as well as upper case      characters. (markt)      + Fix: Add TLS 1.3 groups added in OpenSSL 4.0. (remm)      + Fix: Add validation that the HTTP/2 :scheme pseudo-header is consistent      with the use (or not) of TLS. (markt)      + Fix: Correct the validation of pseudo headers and CONNECT requests to      align Tomcat's behaviour with RFC 9113, section 8.5. (markt)      + Fix: Fix a potential integer overflow when allocating capacity from a      connection level window update to individual HTTP/2 streams. Based on #996      by Mike Tingey Jr. (markt)      + Fix: Switch AJP secret comparison to a constant time algorithm. (markt)
     * WebSocket      + Fix: Fix the initial connection to a WebSocket end point where the      connection is made via a proxy that requires DIGEST authentication.
     * Other      + Fix: 69993: Update the URL to the CDDL 1.0 license. (markt)      + Add: Add warning when OpenSSL binary is not found. (csutherl)      + Add: Add check for Tomcat Native library, and log warning when it's not      found to make it easier to see when it's not used by the suite. (csutherl)      + Update: Update Byte Buddy to 1.18.8. (markt)      + Update: Update Bouncy Castle to 1.84. (markt)      + Update: Improvements to French translations. (remm)      + Update: Improvements to Japanese translations provided by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8383-1 advisory.

    It was discovered that Tomcat incorrectly handled digest authentication. A remote attacker could possibly     use this issue to bypass authentication restrictions. (CVE-2026-43512)

    It was discovered that Tomcat incorrectly handled case sensitivity in LockOutRealm. A remote attacker     could possibly use this issue to bypass account lockout protections and obtain sensitive information.
    (CVE-2026-43513)

    It was discovered that Tomcat incorrectly handled authorization when multiple method constraints defined     the same HTTP method. A remote attacker could possibly use this issue to bypass authorization     restrictions. (CVE-2026-43515)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2675-1 advisory.

    This update for tomcat fixes the following issues

    Update to Tomcat 9.0.118:

    - CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).
    - CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).
    - CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).
    - CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).
    - CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).
    - CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).
    - CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).

    Changes:

     * Catalina      + Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and      OpenSSL version information (both APR and FFM implementations), along with      version compatibility warnings and third-party library version      information. (csutherl)      + Code: Refactor generation of the remote user element in the access log to      remove unnecessary code. (markt)      + Fix: Fix a regression in the previous release that meant ?- could appear      in the access log rather than ? when the query string was present but      empty. (markt)      + Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by      Mahmoud Alarby. (remm)      + Fix: Align the escaping in ExtendedAccessLogValve with the other      AccessLogValve implementations. (markt)      + Fix: 70000: fix duplication of special headers in the response after      commit, following fix for 69967. (remm)      + Fix: Correct the handling of URIs mapped to a security constraint that      only specifies the special ** role for all authenticated users. Requests      without authentication were receiving 403 responses rather than 401      responses. (markt)      + Fix: Fix a race condition in StandardContext.getServletContext() that      could cause the jakarta.servlet.context.tempdir attribute to be lost      during a context reload. Make the context field volatile and use locking      to ensure only one ApplicationContext instance is created. (dsoumis)      + Fix: Update the Windows authentication (kerberos) documentation to reflect      that both Java and Windows are removing / have removed support for      RC4-HMAC. The guide now uses AES256-SHA1. (markt)      + Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize      which limits the size of a WebDAV request body for LOCK and PROPFIND. The      default value is 4096 bytes. (markt)      + Add: Add a new caseSensitive attribute to the LockOutRealm that controls      the manner in which user names are treated when making locking decisions.
     The default is false, meaning user names are treated in a case insensitive      manner. (markt)      + Fix: Correct the handling of invalid users with DIGEST authentication.
     (markt)      + Fix: Ensure RealmBase finds all matching extension based security      constraints. (markt)
     * Coyote      + Fix: Avoid various edge cases if Content-Length is set via      setHeader(String,String) or addHeader(String,String) with an invalid value      by always clearing the previous value whether the new value is valid or      not and ignoring any invalid new value. (markt)      + Code: Refactor the calculation of the real index in the HPACK dynamic      header table implementation to reduce code duplication. (markt)      + Fix: Fix various minor issues with some HTTP/2 stream error messages for      HTTP/2. (markt)      + Fix: Consistently reject URIs containing NULL bytes when normalizing.
     + Fix: Fix a few minor memory leaks on error paths reading TLS keys and      certificates when using FFM. (markt)      + Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC      after a stream reset. (markt)      + Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields      not permitted in trailers. (markt)      + Fix: Free private keys after use in FFM based connector configuration.
     + Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header      decoding that could result in a valid header triggering an unexpected      connection close. (markt)      + Fix: Refactor HTTP/2 HPACK encoding so header field names are only      converted to lower case once during the encoding process. (markt)      + Fix: Refactor HTTP/2 header field validation so it occurs earlier. Extend      validation to check for disallowed characters as well as upper case      characters. (markt)      + Fix: Add TLS 1.3 groups added in OpenSSL 4.0. (remm)      + Fix: Add validation that the HTTP/2 :scheme pseudo-header is consistent      with the use (or not) of TLS. (markt)      + Fix: Correct the validation of pseudo headers and CONNECT requests to      align Tomcat's behaviour with RFC 9113, section 8.5. (markt)      + Fix: Fix a potential integer overflow when allocating capacity from a      connection level window update to individual HTTP/2 streams. Based on #996      by Mike Tingey Jr. (markt)      + Fix: Switch AJP secret comparison to a constant time algorithm. (markt)
     * WebSocket      + Fix: Fix the initial connection to a WebSocket end point where the      connection is made via a proxy that requires DIGEST authentication.
     * Other      + Fix: 69993: Update the URL to the CDDL 1.0 license. (markt)      + Add: Add warning when OpenSSL binary is not found. (csutherl)      + Add: Add check for Tomcat Native library, and log warning when it's not      found to make it easier to see when it's not used by the suite. (csutherl)      + Update: Update Byte Buddy to 1.18.8. (markt)      + Update: Update Bouncy Castle to 1.84. (markt)      + Update: Improvements to French translations. (remm)      + Update: Improvements to Japanese translations provided by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6328 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6328-1                   security@debian.org     https://www.debian.org/security/                          Markus Koschany     June 08, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : tomcat10     CVE ID         : CVE-2026-24880 CVE-2026-25854 CVE-2026-29129 CVE-2026-29145                      CVE-2026-29146 CVE-2026-32990 CVE-2026-34483 CVE-2026-34487                      CVE-2026-34500 CVE-2026-41284 CVE-2026-41293 CVE-2026-42498                      CVE-2026-43512 CVE-2026-43513 CVE-2026-43514 CVE-2026-43515

    Multiple security vulnerabilities have been discovered in Tomcat 10, a Java     based web server, servlet and JSP engine which may result in a denial of     service, authentication bypass or the disclosure of sensitive information.

    Although we are not aware of any problems, new upstream versions may introduce     new options, limits or code changes which may or may not affect your existing     web applications. We recommend to consult the Tomcat 10 documentation for     further information.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 10.1.55-1~deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 10.1.55-1~deb13u1.

    We recommend that you upgrade your tomcat10 packages.

    For the detailed security status of tomcat10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tomcat10

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68680 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)

    * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)

    * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during     WebSocket authentication. (CVE-2026-42498)

    * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)

    * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)

    * tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration     (CVE-2026-55957)

    * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve     (CVE-2026-59083)

    * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure     configurations (CVE-2026-59084)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68679 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix     (CVE-2026-32990)

    * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)

    * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)

    * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during     WebSocket authentication. (CVE-2026-42498)

    * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)

    * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)

    * tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration     (CVE-2026-55957)

    * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve     (CVE-2026-59083)

    * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure     configurations (CVE-2026-59084)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
321012	SUSE SLES12 Security Update : tomcat (SUSE-SU-2026:2299-1)	Nessus	SuSE Local Security Checks	2026/6/14	2026/6/14	critical
318841	Ubuntu 14.04 LTS / 16.04 LTS : Tomcat vulnerabilities (USN-8383-1)	Nessus	Ubuntu Local Security Checks	2026/6/5	2026/6/10	critical
323892	SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / etc (SUSE-SU-2026:2675-1)	Nessus	SuSE Local Security Checks	2026/6/30	2026/6/30	critical
319682	Debian dsa-6328 : libtomcat10-embed-java - security update	Nessus	Debian Local Security Checks	2026/6/8	2026/6/8	high
346918	RHEL 8 : tomcat (RHSA-2026:68680)	Nessus	Red Hat Local Security Checks	2026/9/17	2026/9/17	critical
346928	RHEL 9 : tomcat (RHSA-2026:68679)	Nessus	Red Hat Local Security Checks	2026/9/17	2026/9/17	medium

检测

插件搜索

critical

critical

critical

high

critical

medium