The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68677 advisory.

    * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
      * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
      * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during     WebSocket authentication. (CVE-2026-42498)
      * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
      * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
      * tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI     configuration (CVE-2026-55957)
      * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve     (CVE-2026-59083)
      * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure     configurations (CVE-2026-59084)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1151 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-52316:
    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta     Authentication (formerly JASPIC)ServerAuthContext component which may throw an exception during the     authentication process without explicitly setting an HTTP status to indicate failure, the authentication     may not fail, allowing the user to bypass the authentication process. There are no known     JakartaAuthentication components that behave in this way.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from     9.0.0-M1 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.

    CVE-2024-54677:
    Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.9.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

    CVE-2025-46701:
    Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security     constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI     servlet.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from     9.0.0.M1 through 9.0.104.

    Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

    CVE-2025-55668:
    Session Fixation vulnerability in Apache Tomcat via rewrite valve.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from     9.0.0.M1 through 9.0.105.
    Older, EOL versions may also be affected.

    Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

    CVE-2025-55754:
    Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.

    Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a     Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker     to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard     and attempt to trick an administrator into running an attacker controlled command. While no attack vector     was found, it may have been possible to mount this attack on other operating systems.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from     9.0.40 through 9.0.108.

    The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected.
    Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which     fix the issue.

    CVE-2025-61795:
    Improper Resource Shutdown or Release vulnerability in Apache Tomcat.

    If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary     copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage     collection process to delete. Depending on JVM settings, application memory usage and application load, it     was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared     it, leading to a DoS.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from     9.0.0.M1 through 9.0.109.

    The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
    Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which     fixes the issue.

    CVE-2025-66614:
    Improper Input Validation vulnerability.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from     9.0.0-M1 through 9.0.112.

    The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected.
    Tomcat did not validate that the host name provided via the SNI     extension was the same as the host name provided in the HTTP host header     field. If Tomcat was configured with more than one virtual host and the     TLS configuration for one of those hosts did not require client     certificate authentication but another one did, it was possible for a     client to bypass the client certificate authentication by sending     different host names in the SNI extension and the HTTP host header field.



    The vulnerability only applies if client certificate authentication is     only enforced at the Connector. It does not apply if client certificate     authentication is enforced at the web application.


    Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which     fix the issue.

    CVE-2026-24733:
    Improper Input Validation vulnerability in Apache Tomcat.


    Tomcat did not limit HTTP/0.9 requests to the GET method. If a security     constraint was configured to allow HEAD requests to a URI but deny GET     requests, the user could bypass that constraint on GET requests by     sending a (specification invalid) HEAD request using HTTP/0.9.


    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from     9.0.0.M1 through 9.0.112.


    Older, EOL versions are also affected.

    Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which     fixes the issue.

    CVE-2026-24880:
    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache     Tomcat via invalid chunk extension.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from     9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
    Other, unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

    CVE-2026-25854:
    Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the     LoadBalancerDrainingValve.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from     9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
    Other, unsupported versions may also be affected

    Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

    CVE-2026-29145:
    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat, Apache Tomcat Native.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from     9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from     1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

    Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and     9.0.116, which fix the issue.

    CVE-2026-34483:
    Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache     Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from     9.0.40 through 9.0.116.

    Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.

    CVE-2026-34487:
    Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering     component of Apache Tomcat exposed the Kubernetes bearer token.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from     9.0.13 through 9.0.116.

    Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

    CVE-2026-41284:
    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.0.M1 through 9.0.117.
    Older, unsupported versions may also be affected.

    Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

    CVE-2026-41293:
    Improper Input Validation vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.
    Older, end of support versions may also be affected.

    Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

    CVE-2026-42498:
    Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability     in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.

    CVE-2026-43512:
    DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.
    Older unsupported versions any also be affect

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

    CVE-2026-43513:
    Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
    Older unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

    CVE-2026-43514:
    Observable Timing Discrepancy vulnerabilitywhen comparing AJP secret in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
    Older unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

    CVE-2026-43515:
    Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same     extension in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from     9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

    Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

    CVE-2026-50229:
    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number     guess example for Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

    CVE-2026-53404:
    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if     the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

    CVE-2026-53434:
    Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM     based connector.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from     9.0.83 through 9.0.118.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

    CVE-2026-55276:
    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and     empty authorisation constraints were not included when the effective web.xml was logged.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100.Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

    CVE-2026-55955:
    Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the     EncryptionInterceptor in the cluster component.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

    Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

    CVE-2026-55956:
    Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the     default servlet ignoring any method or method omission configured as part of the constraint.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

    CVE-2026-55957:
    Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured     to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct     password.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from     9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

    Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

    CVE-2026-59083:
    Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed     security constraint bypass for some configurations.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100.Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

    CVE-2026-59084:
    Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely     configure the EncryptInterceptor were not clearly documented.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.Other versions that     have reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68651 advisory.

    Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet     and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by     Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and     released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the     best-of-breed developers from around the world.

    Security Fix(es):

    * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix     (CVE-2026-32990)

    * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)

    * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)

    * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during     WebSocket authentication. (CVE-2026-42498)

    * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)

    * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)

    * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve     (CVE-2026-59083)

    * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure     configurations (CVE-2026-59084)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.56. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.56_security-10 advisory.

  - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and     empty authorisation constraints were not included when the effective web.xml was logged. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1     through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be     affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
    (CVE-2026-55276)

  - Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the     default servlet ignoring any method or method omission configured as part of the constraint. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1     through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached     end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or     9.0.119, which fix the issue. (CVE-2026-55956)

  - Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the     EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from     7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which     fixes the issue. (CVE-2026-55955)

  - Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM     based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through     10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or     9.0.119, which fixes the issue. (CVE-2026-53434)

  - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if     the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through     9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-53404)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22646-1 advisory.

    This update for tomcat fixes the following issues

    Update to Tomcat 9.0.119.

    Security issues fixed:

    - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example     (bsc#1269791).
    - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR     conditions to be       skipped if the first condition in an OR chain matched (bsc#1269910).
    - CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector     (bsc#1269824).
    - CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty     authorization constraints       to not be included when the effective web.xml was logged (bsc#1269909).
    - CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the     cluster       component (bsc#1269908).
    - CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet     ignoring any       method or method omission configured as part of the constraint (bsc#1269907).

    Other updates and bugfixes:

    - Tomcat 9.0.119:
      * Catalina
        - Add: Add support for literal '%' characters in access log output. Based on           pull request #1002 by Fabian Hahn. (markt)
        - Fix: Prevent duplicate log messages when clustering JARs are not present           on startup. (csutherl)
        - Code: Remove unnecessary code from the SSI processing engine that was           duplicating some of the normalisation checks. (markt)
        - Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
        - Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
          (remm)
        - Fix: Incorrect session average life calculation. (remm)
        - Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
          (remm)
        - Fix: Avoid any init parameter updates when conflicts are found for           filters, similar to what is done for servlets, as required by the servlet           specification. (remm)
        - Fix: Fix container event cleanups in some edge cases. (remm)
        - Fix: Check for last-modified header in ExpiresFilter when a servlet uses           addDateHeader to avoid wrongly considering it has been set. (remm)
        - Fix: Fix hour unit used by ExpiresFilter. (remm)
        - Fix: Remove exception swallowing in DataSourceStore to align it with           FileStore and avoid session loss on errors. (remm)
        - Fix: Add support for single-quote escaped literal as well as quoted           literals in DateFormatCache. (schultz)
        - Fix: On JAAS logout, clear out role principals on the subject that were           added on commit, as recommended by the JAAS specification. (remm)
        - Fix: MemoryRealm should not add a dummy role when none is specified in the           configuration. (remm)
        - Fix: DataSourceUserDatabase should return a null principal on a non           existing user. (remm)
        - Fix: Fix shared lock expiration in WebDAV. (remm)
        - Fix: Inaccurate session exipration statistics when using the persistent           manager. (remm)
        - Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
        - Fix: Mixup of WrapperListener and WrapperLifecycle elements in           storeconfig. (remm)
        - Fix: Incorrect processing of modified users in DataSourceUserDatabase.
          (remm)
        - Update: Clarify behavior in the UserDatabase for user, role and group           creation that it does not immediately override existing elements. Removal           (or update) needs to be used instead. (remm)
        - Fix: 70049: Align the web application class loader with parent class           loaders and swallow any errors caused by invalid paths when looking up           resources and behave as if the resources were not found in that case.
          (markt)
        - Fix: Improve validation of Range and Content-Range parsers so invalid           ranges trigger a 4xx response rather than a 500 response. Pull request           #1012 provided by Sahana Surendra Bogar. (markt)         + Fix: Fix connection leak in ProxyErrorReportValve. (remm)         + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off           rather than true or false to align with httpd. (markt)         + Fix: Reset the encoding used for query string parameters between requests           in case an application changed the encoding in a previous request. (markt)         + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce           to URLs that are known not to require it. (markt)         + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least           one sub realm is available. (remm)         + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
          (markt)         + Fix: Improve the detection of cross-context dispatches when using a           RequestDispatcher. (markt)         + Fix: Fix various instances of double decoding of URL patterns configured           either programmatically or in web.xml. (remm/markt)         + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,           which follows a purely sequential evaluation strategy. (remm)         + Fix: Change the default for the useRedirect attribute of the           ProxyErrorReportValve from true to false. (markt)         + Add: Add support for the showReport attribute in JsonErrorReportValve and           ProxyErrorReportValve. When set to false, detailed error information           (message, description, stack trace) is suppressed from error responses.
          (dsoumis)         + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is           removed but catalina-ha.jar is present and the Cluster element is enabled           in server.xml. Cluster digester rules are now fully conditional on both           JARs being available. (dsoumis)         + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)         + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list           of reserved prefixes for SSI variables and request attributes. (markt)         + Fix: Missing URL decoding when processing addMapping on a Servlet           registration. (remm)         + Fix: The Timeout WebDAV header allows comma separated values (according to           the examples in the RFC). Use the first acceptable value. (remm)         + Fix: Fix various issues when logging the effective web.xml for a web           application. Empty sections are no longer logged. Special roles and empty           authorisation constraints are included. (markt)         + Fix: Expand the write lock for the save process in the MemoryUserDatabase           to avoid concurrency issues with the file save operations. (markt)         + Fix: Ensure atomic session persistence in FileStore. Based on pull request           #1016 by sahvx655-wq. (markt)         + Fix: Do not ignore methods configured on security constraints that map to           the default servlet. (markt)
      * Cluster         + Fix: Expand wording and increase visibility of log message when cloud           membership is configured without a trust store as all certificates will be           trusted in this configuration. (markt)         + Fix: Ensure listeners are correctly added and removed when configuring the           channel coordinator. (markt)         + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)         + Fix: Fix some concurrency issues in OrderInterceptor. (markt)         + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)         + Fix: Fix concurrency issues generating MD5 digests in the           CloudMembershipProvider implementations. (markt)         + Add: Add replay protection to the EncryptInterceptor. This is a breaking           change for the EncryptInterceptor. (markt)
      * Coyote         + Add: Log a suitable warning if an encrypted PEM file is detected using an           insecure form for encryption. (markt)         + Fix: If TLS groups have been configured, use the configured groups rather           than using OpenSSL's default TLS groups when using Tomcat Native with           OpenSSL based connectors. (markt)         + Fix: For HTTP/2, ensure that any in progress request body reads are           cancelled if the container resets the associated stream. This prevents           delays waiting for reads to time out when it is known that no more data           will be received. (markt)         + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream           reset do so, rather than triggered a connection close. (markt)         + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)         + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,           following refactor clean-up of header buffer. (remm)         + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)         + Fix: Fix MessageByte.equals if called on a null MB. (remm)         + Fix: Call the delegate key manager in JSSE to retrieve the server key.
          (remm)         + Fix: Avoid overflow scenarios in Asn1Parser. (remm)         + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that           allows the consistency check for the scheme provided by the user agent to           be bypassed. (markt)         + Fix: isTrailerFieldsReady was always returning true. (remm)         + Fix: Align OpenSSL/Panama TLS implementation with other implementations           and throw an exception if there is an error loading the provided CRL(s).
          (markt)         + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if           @STRENGTH was encountered, ignoring any subsequent expressions. (markt)         + Fix: Handle the case where the HTTP/2 payload length is insufficient for           the mandatory data required by the flags set in the header. (markt)         + Fix: 70102: Correct expected size of ticket keys when calling           setSessionTicketKeys with an FFM connector. (markt)         + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken           by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)         + Fix: When processing an OpenSSL cipher specification, fully align the           order of the resulting ciphers with the order produced by OpenSSL. (markt)         + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
          (schultz)         + Update: Update both the minimum and recommended version for Tomcat Native           1.x to 1.3.8. (markt)
      * Jasper         + Fix: Fix possible EL argument mismatch when it was set to null. (remm)         + Fix: Fix thread safety of TagPluginManager. (remm)         + Fix: Correctly use flush on JSP include. (remm)
      * Web applications         + Add: Manager: Add checks to ensure that any uploaded files are uploaded to           the expected location. (markt)         + Add: Manager: Add checks to ensure that the requested context path for a           deployed WAR, directory or descriptor file is valid. (markt)         + Add: Documentation: Expand the description of some of the attributes of           the CrawlerSessionManagerValve. (markt)         + Fix: Documentation: Clearer description and correct documented default for           ocspSoftFail. (markt)         + Fix: Fix double escaping in the context names for the JSON mode of the           manager servlet. (remm)         + Fix: Manager: Ensure automatic deployment does not trigger an undeployment           during a Manager triggered web application reload. (markt)         + Fix: Documentation: Provide better documentation for the scheme and secure           attributes of a Connector. (markt)
      * Websocket         + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)         + Fix: Trigger standard WebSocket error handling if a call to           Endpoint.onOpen() fails for a programmatic endpoint. (markt)         + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a           programmatic endpoint. Test case provided by uabdur. (markt)         + Fix: If a client presents invalid parameters when negotiating a WebSocket           extension, decline the negotiation offer that includes the invalid           parameters rather than failing the connection. Pull request #1019 provided           by sahvx655-wq. (markt)
      * Other         + Fix: Wrong references to jakarta instead of javax. (remm)         + Fix: Restore default authenticator to nullafter executing an Ant task.
          (remm)         + Update: Update Commons Daemon to 1.6.1. (markt)         + Update: Improvements to French translations. (remm)         + Update: Improvements to Japanese translations provided by tak7iji. (markt)         + Update: Update Tomcat Native to 1.3.8. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3112-1 advisory.

    This update for tomcat10 fixes the following issues

    Update to Tomcat 10.1.56.

    Security issues fixed:

    - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example     (bsc#1269791).
    - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR     conditions to be       skipped if the first condition in an OR chain matched (bsc#1269910).
    - CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector     (bsc#1269824).
    - CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty     authorization constraints       to not be included when the effective web.xml was logged (bsc#1269909).
    - CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the     cluster       component (bsc#1269908).
    - CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet     ignoring any       method or method omission configured as part of the constraint (bsc#1269907).

    Other updates and bugfixes:

    - Tomcat 10.1.56:
      * Catalina
        - Add: Add support for literal '%' characters in access log output. Based on           pull request #1002 by Fabian Hahn. (markt)
        - Fix: Prevent duplicate log messages when clustering JARs are not present           on startup. (csutherl)
        - Fix: 70038: Cookie.clone() should also clone the internal attribute map.
          (markt)
        - Code: Remove unnecessary code from the SSI processing engine that was           duplicating some of the normalisation checks. (markt)
        - Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
        - Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
          (remm)
        - Fix: Incorrect session average life calculation. (remm)
        - Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
          (remm)
        - Fix: Avoid any init parameter updates when conflicts are found for           filters, similar to what is done for servlets, as required by the servlet           specification. (remm)
        - Fix: Fix container event cleanups in some edge cases. (remm)
        - Fix: Check for last-modified header in ExpiresFilter when a servlet uses           addDateHeader to avoid wrongly considering it has been set. (remm)
        - Fix: Fix hour unit used by ExpiresFilter. (remm)
        - Fix: Remove exception swallowing in DataSourceStore to align it with           FileStore and avoid session loss on errors. (remm)
        - Fix: Add support for single-quote escaped literal as well as quoted           literals in DateFormatCache. (schultz)
        - Fix: On JAAS logout, clear out role principals on the subject that were           added on commit, as recommended by the JAAS specification. (remm)
        - Fix: MemoryRealm should not add a dummy role when none is specified in the           configuration. (remm)
        - Fix: DataSourceUserDatabase should return a null principal on a non           existing user. (remm)
        - Fix: Fix shared lock expiration in WebDAV. (remm)
        - Fix: Inaccurate session exipration statistics when using the persistent           manager. (remm)
        - Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
        - Fix: Mixup of WrapperListener and WrapperLifecycle elements in           storeconfig. (remm)
        - Fix: Incorrect processing of modified users in DataSourceUserDatabase.
          (remm)
        - Update: Clarify behavior in the UserDatabase for user, role and group           creation that it does not immediately override existing elements. Removal           (or update) needs to be used instead. (remm)
        - Fix: 70049: Align the web application class loader with parent class           loaders and swallow any errors caused by invalid paths when looking up           resources and behave as if the resources were not found in that case.
          (markt)         + Fix: Improve validation of Range and Content-Range parsers so invalid           ranges trigger a 4xx response rather than a 500 response. Pull request           #1012 provided by Sahana Surendra Bogar. (markt)         + Fix: Fix connection leak in ProxyErrorReportValve. (remm)         + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off           rather than true or false to align with httpd. (markt)         + Fix: Reset the encoding used for query string parameters between requests           in case an application changed the encoding in a previous request. (markt)         + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce           to URLs that are known not to require it. (markt)         + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least           one sub realm is available. (remm)         + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
          (markt)         + Fix: Improve the detection of cross-context dispatches when using a           RequestDispatcher. (markt)         + Fix: Fix various instances of double decoding of URL patterns configured           either programmatically or in web.xml. (remm/markt)         + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,           which follows a purely sequential evaluation strategy. (remm)         + Fix: Change the default for the useRedirect attribute of the           ProxyErrorReportValve from true to false. (markt)         + Add: Add support for the showReport attribute in JsonErrorReportValve and           ProxyErrorReportValve. When set to false, detailed error information           (message, description, stack trace) is suppressed from error responses.
          (dsoumis)         + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is           removed but catalina-ha.jar is present and the Cluster element is enabled           in server.xml. Cluster digester rules are now fully conditional on both           JARs being available. (dsoumis)         + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)         + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list           of reserved prefixes for SSI variables and request attributes. (markt)         + Fix: Missing URL decoding when processing addMapping on a Servlet           registration. (remm)         + Fix: The Timeout WebDAV header allows comma separated values (according to           the examples in the RFC). Use the first acceptable value. (remm)         + Fix: Fix various issues when logging the effective web.xml for a web           application. Empty sections are no longer logged. Special roles and empty           authorisation constraints are included. All session cookie attributes are           included. (markt)         + Fix: Expand the write lock for the save process in the MemoryUserDatabase           to avoid concurrency issues with the file save operations. (markt)         + Fix: Ensure atomic session persistence in FileStore. Based on pull request           #1016 by sahvx655-wq. (markt)         + Fix: Do not ignore methods configured on security constraints that map to           the default servlet. (markt)
      * Cluster         + Fix: Expand wording and increase visibility of log message when cloud           membership is configured without a trust store as all certificates will be           trusted in this configuration. (markt)         + Fix: Ensure listeners are correctly added and removed when configuring the           channel coordinator. (markt)         + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)         + Fix: Fix some concurrency issues in OrderInterceptor. (markt)         + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)         + Fix: Fix concurrency issues generating MD5 digests in the           CloudMembershipProvider implementations. (markt)         + Add: Add replay protection to the EncryptInterceptor. This is a breaking           change for the EncryptInterceptor. (markt)
      * Coyote         + Add: Log a suitable warning if an encrypted PEM file is detected using an           insecure form for encryption. (markt)         + Fix: If TLS groups have been configured, use the configured groups rather           than using OpenSSL's default TLS groups when using Tomcat Native with           OpenSSL based connectors. (markt)         + Fix: For HTTP/2, ensure that any in progress request body reads are           cancelled if the container resets the associated stream. This prevents           delays waiting for reads to time out when it is known that no more data           will be received. (markt)         + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream           reset do so, rather than triggered a connection close. (markt)         + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)         + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,           following refactor clean-up of header buffer. (remm)         + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)         + Fix: Fix MessageByte.equals if called on a null MB. (remm)         + Fix: Call the delegate key manager in JSSE to retrieve the server key.
          (remm)         + Fix: Avoid overflow scenarios in Asn1Parser. (remm)         + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that           allows the consistency check for the scheme provided by the user agent to           be bypassed. (markt)         + Fix: isTrailerFieldsReady was always returning true. (remm)         + Fix: Align OpenSSL/Panama TLS implementation with other implementations           and throw an exception if there is an error loading the provided CRL(s).
          (markt)         + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if           @STRENGTH was encountered, ignoring any subsequent expressions. (markt)         + Fix: Handle the case where the HTTP/2 payload length is insufficient for           the mandatory data required by the flags set in the header. (markt)         + Fix: 70102: Correct expected size of ticket keys when calling           setSessionTicketKeys with an FFM connector. (markt)         + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken           by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)         + Fix: When processing an OpenSSL cipher specification, fully align the           order of the resulting ciphers with the order produced by OpenSSL. (markt)         + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
          (schultz)         + Update: Update both the minimum and recommended version for Tomcat Native           2.x to 2.0.15. (markt)         + Update: Update the minimum version for Tomcat Native 1.x to 1.3.8. (markt)
      * Jasper         + Fix: Fix possible EL argument mismatch when it was set to null. (remm)         + Fix: Fix thread safety of TagPluginManager. (remm)         + Fix: Correctly use flush on JSP include. (remm)
      * Web applications         + Add: Manager: Add checks to ensure that any uploaded files are uploaded to           the expected location. (markt)         + Add: Manager: Add checks to ensure that the requested context path for a           deployed WAR, directory or descriptor file is valid. (markt)         + Add: Documentation: Expand the description of some of the attributes of           the CrawlerSessionManagerValve. (markt)         + Fix: Documentation: Clearer description and correct documented default for           ocspSoftFail. (markt)         + Fix: Fix double escaping in the context names for the JSON mode of the           manager servlet. (remm)         + Fix: Manager: Ensure automatic deployment does not trigger an undeployment           during a Manager triggered web application reload. (markt)         + Fix: Documentation: Provide better documentation for the scheme and secure           attributes of a Connector. (markt)
      * Websocket         + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)         + Fix: Trigger standard WebSocket error handling if a call to           Endpoint.onOpen() fails for a programmatic endpoint. (markt)         + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a           programmatic endpoint. Test case provided by uabdur. (markt)         + Fix: If a client presents invalid parameters when negotiating a WebSocket           extension, decline the negotiation offer that includes the invalid           parameters rather than failing the connection. Pull request #1019 provided           by sahvx655-wq. (markt)
      * Other         + Fix: Use per connection authenticator when executing an Ant task.
          (remm/markt)         + Update: Update Commons Daemon to 1.6.1. (markt)         + Update: Improvements to French translations. (remm)         + Update: Improvements to Japanese translations provided by tak7iji. (markt)         + Update: Update the packaged version of the Tomcat Migration Tool for           Jakarta EE to 1.0.12. (markt)         + Update: Update Tomcat Native to 2.0.15. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68660 advisory.

    * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix     (CVE-2026-32990)
      * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
      * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
      * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during     WebSocket authentication. (CVE-2026-42498)
      * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
      * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
      * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve     (CVE-2026-59083)
      * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure     configurations (CVE-2026-59084)


    Bug Fix(es) and Enhancement(s):

      * Tomcat fails to respond to client connections when using Java 8 [almalinux-9.8]     (JIRA:AlmaLinux-257456)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:68651 advisory.

    * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix     (CVE-2026-32990)

    * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)

    * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)

    * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during     WebSocket authentication. (CVE-2026-42498)

    * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)

    * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)

    * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve     (CVE-2026-59083)

    * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure     configurations (CVE-2026-59084)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1945 advisory.

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number     guess example for Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-50229)

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if     the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-53404)

    Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM     based connector.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from     9.0.83 through 9.0.118.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
    (CVE-2026-53434)

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and     empty authorisation constraints were not included when the effective web.xml was logged.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
    (CVE-2026-55276)

    Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the     EncryptionInterceptor in the cluster component.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

    Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.
    (CVE-2026-55955)

    Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the     default servlet ignoring any method or method omission configured as part of the constraint.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-55956)

    Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed     security constraint bypass for some configurations.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
    (CVE-2026-59083)

    Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely     configure the EncryptInterceptor were not clearly documented.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that     have reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.
    (CVE-2026-59084)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3167-1 advisory.

    This update for tomcat fixes the following issues

    Update to Tomcat 9.0.119.

    Security issues fixed:

    - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example     (bsc#1269791).
    - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR     conditions to be       skipped if the first condition in an OR chain matched (bsc#1269910).
    - CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector     (bsc#1269824).
    - CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty     authorization constraints       to not be included when the effective web.xml was logged (bsc#1269909).
    - CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the     cluster       component (bsc#1269908).
    - CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet     ignoring any       method or method omission configured as part of the constraint (bsc#1269907).

    Other updates and bugfixes:

    - Tomcat 9.0.119
      * Catalina
        - Add: Add support for literal '%' characters in access log output. Based on           pull request #1002 by Fabian Hahn. (markt)
        - Fix: Prevent duplicate log messages when clustering JARs are not present           on startup. (csutherl)
        - Code: Remove unnecessary code from the SSI processing engine that was           duplicating some of the normalisation checks. (markt)
        - Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
        - Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
          (remm)
        - Fix: Incorrect session average life calculation. (remm)
        - Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
          (remm)
        - Fix: Avoid any init parameter updates when conflicts are found for           filters, similar to what is done for servlets, as required by the servlet           specification. (remm)
        - Fix: Fix container event cleanups in some edge cases. (remm)
        - Fix: Check for last-modified header in ExpiresFilter when a servlet uses           addDateHeader to avoid wrongly considering it has been set. (remm)
        - Fix: Fix hour unit used by ExpiresFilter. (remm)
        - Fix: Remove exception swallowing in DataSourceStore to align it with           FileStore and avoid session loss on errors. (remm)
        - Fix: Add support for single-quote escaped literal as well as quoted           literals in DateFormatCache. (schultz)
        - Fix: On JAAS logout, clear out role principals on the subject that were           added on commit, as recommended by the JAAS specification. (remm)
        - Fix: MemoryRealm should not add a dummy role when none is specified in the           configuration. (remm)
        - Fix: DataSourceUserDatabase should return a null principal on a non           existing user. (remm)
        - Fix: Fix shared lock expiration in WebDAV. (remm)
        - Fix: Inaccurate session exipration statistics when using the persistent           manager. (remm)
        - Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
        - Fix: Mixup of WrapperListener and WrapperLifecycle elements in           storeconfig. (remm)
        - Fix: Incorrect processing of modified users in DataSourceUserDatabase.
          (remm)
        - Update: Clarify behavior in the UserDatabase for user, role and group           creation that it does not immediately override existing elements. Removal           (or update) needs to be used instead. (remm)
        - Fix: 70049: Align the web application class loader with parent class           loaders and swallow any errors caused by invalid paths when looking up           resources and behave as if the resources were not found in that case.
          (markt)
        - Fix: Improve validation of Range and Content-Range parsers so invalid           ranges trigger a 4xx response rather than a 500 response. Pull request           #1012 provided by Sahana Surendra Bogar. (markt)         + Fix: Fix connection leak in ProxyErrorReportValve. (remm)         + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off           rather than true or false to align with httpd. (markt)         + Fix: Reset the encoding used for query string parameters between requests           in case an application changed the encoding in a previous request. (markt)         + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce           to URLs that are known not to require it. (markt)         + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least           one sub realm is available. (remm)         + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
          (markt)         + Fix: Improve the detection of cross-context dispatches when using a           RequestDispatcher. (markt)         + Fix: Fix various instances of double decoding of URL patterns configured           either programmatically or in web.xml. (remm/markt)         + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,           which follows a purely sequential evaluation strategy. (remm)         + Fix: Change the default for the useRedirect attribute of the           ProxyErrorReportValve from true to false. (markt)         + Add: Add support for the showReport attribute in JsonErrorReportValve and           ProxyErrorReportValve. When set to false, detailed error information           (message, description, stack trace) is suppressed from error responses.
          (dsoumis)         + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is           removed but catalina-ha.jar is present and the Cluster element is enabled           in server.xml. Cluster digester rules are now fully conditional on both           JARs being available. (dsoumis)         + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)         + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list           of reserved prefixes for SSI variables and request attributes. (markt)         + Fix: Missing URL decoding when processing addMapping on a Servlet           registration. (remm)         + Fix: The Timeout WebDAV header allows comma separated values (according to           the examples in the RFC). Use the first acceptable value. (remm)         + Fix: Fix various issues when logging the effective web.xml for a web           application. Empty sections are no longer logged. Special roles and empty           authorisation constraints are included. (markt)         + Fix: Expand the write lock for the save process in the MemoryUserDatabase           to avoid concurrency issues with the file save operations. (markt)         + Fix: Ensure atomic session persistence in FileStore. Based on pull request           #1016 by sahvx655-wq. (markt)         + Fix: Do not ignore methods configured on security constraints that map to           the default servlet. (markt)
      * Cluster         + Fix: Expand wording and increase visibility of log message when cloud           membership is configured without a trust store as all certificates will be           trusted in this configuration. (markt)         + Fix: Ensure listeners are correctly added and removed when configuring the           channel coordinator. (markt)         + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)         + Fix: Fix some concurrency issues in OrderInterceptor. (markt)         + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)         + Fix: Fix concurrency issues generating MD5 digests in the           CloudMembershipProvider implementations. (markt)         + Add: Add replay protection to the EncryptInterceptor. This is a breaking           change for the EncryptInterceptor. (markt)
      * Coyote         + Add: Log a suitable warning if an encrypted PEM file is detected using an           insecure form for encryption. (markt)         + Fix: If TLS groups have been configured, use the configured groups rather           than using OpenSSL's default TLS groups when using Tomcat Native with           OpenSSL based connectors. (markt)         + Fix: For HTTP/2, ensure that any in progress request body reads are           cancelled if the container resets the associated stream. This prevents           delays waiting for reads to time out when it is known that no more data           will be received. (markt)         + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream           reset do so, rather than triggered a connection close. (markt)         + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)         + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,           following refactor clean-up of header buffer. (remm)         + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)         + Fix: Fix MessageByte.equals if called on a null MB. (remm)         + Fix: Call the delegate key manager in JSSE to retrieve the server key.
          (remm)         + Fix: Avoid overflow scenarios in Asn1Parser. (remm)         + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that           allows the consistency check for the scheme provided by the user agent to           be bypassed. (markt)         + Fix: isTrailerFieldsReady was always returning true. (remm)         + Fix: Align OpenSSL/Panama TLS implementation with other implementations           and throw an exception if there is an error loading the provided CRL(s).
          (markt)         + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if           @STRENGTH was encountered, ignoring any subsequent expressions. (markt)         + Fix: Handle the case where the HTTP/2 payload length is insufficient for           the mandatory data required by the flags set in the header. (markt)         + Fix: 70102: Correct expected size of ticket keys when calling           setSessionTicketKeys with an FFM connector. (markt)         + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken           by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)         + Fix: When processing an OpenSSL cipher specification, fully align the           order of the resulting ciphers with the order produced by OpenSSL. (markt)         + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
          (schultz)         + Update: Update both the minimum and recommended version for Tomcat Native           1.x to 1.3.8. (markt)
      * Jasper         + Fix: Fix possible EL argument mismatch when it was set to null. (remm)         + Fix: Fix thread safety of TagPluginManager. (remm)         + Fix: Correctly use flush on JSP include. (remm)
      * Web applications         + Add: Manager: Add checks to ensure that any uploaded files are uploaded to           the expected location. (markt)         + Add: Manager: Add checks to ensure that the requested context path for a           deployed WAR, directory or descriptor file is valid. (markt)         + Add: Documentation: Expand the description of some of the attributes of           the CrawlerSessionManagerValve. (markt)         + Fix: Documentation: Clearer description and correct documented default for           ocspSoftFail. (markt)         + Fix: Fix double escaping in the context names for the JSON mode of the           manager servlet. (remm)         + Fix: Manager: Ensure automatic deployment does not trigger an undeployment           during a Manager triggered web application reload. (markt)         + Fix: Documentation: Provide better documentation for the scheme and secure           attributes of a Connector. (markt)
      * Websocket         + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)         + Fix: Trigger standard WebSocket error handling if a call to           Endpoint.onOpen() fails for a programmatic endpoint. (markt)         + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a           programmatic endpoint. Test case provided by uabdur. (markt)         + Fix: If a client presents invalid parameters when negotiating a WebSocket           extension, decline the negotiation offer that includes the invalid           parameters rather than failing the connection. Pull request #1019 provided           by sahvx655-wq. (markt)
      * Other         + Fix: Wrong references to jakarta instead of javax. (remm)         + Fix: Restore default authenticator to nullafter executing an Ant task.
          (remm)         + Update: Update Commons Daemon to 1.6.1. (markt)         + Update: Improvements to French translations. (remm)         + Update: Improvements to Japanese translations provided by tak7iji. (markt)         + Update: Update Tomcat Native to 1.3.8. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.119. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.119_security-9 advisory.

  - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and     empty authorisation constraints were not included when the effective web.xml was logged. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1     through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be     affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
    (CVE-2026-55276)

  - Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the     default servlet ignoring any method or method omission configured as part of the constraint. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1     through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached     end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or     9.0.119, which fix the issue. (CVE-2026-55956)

  - Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the     EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from     7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which     fixes the issue. (CVE-2026-55955)

  - Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM     based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through     10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or     9.0.119, which fixes the issue. (CVE-2026-53434)

  - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if     the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through     9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-53404)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1946 advisory.

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number     guess example for Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-50229)

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if     the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-53404)

    Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM     based connector.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from     9.0.83 through 9.0.118.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
    (CVE-2026-53434)

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and     empty authorisation constraints were not included when the effective web.xml was logged.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
    (CVE-2026-55276)

    Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the     EncryptionInterceptor in the cluster component.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

    Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.
    (CVE-2026-55955)

    Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the     default servlet ignoring any method or method omission configured as part of the constraint.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from     9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have     reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-55956)

    Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed     security constraint bypass for some configurations.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may     also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
    (CVE-2026-59083)

    Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely     configure the EncryptInterceptor were not clearly documented.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from     9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that     have reached end of support may also be affected.

    Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.
    (CVE-2026-59084)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
347977	AlmaLinux 8 : tomcat (ALSA-2026:68677)	Nessus	Alma Linux Local Security Checks	2026/9/18	2026/9/25	medium
365137	TencentOS Server 3: tomcat (TSSA-2026:1151)	Nessus	Tencent Local Security Checks	2026/10/12	2026/10/12	medium
348183	RHEL 10 : tomcat9 (RHSA-2026:68651)	Nessus	Red Hat Local Security Checks	2026/9/18	2026/9/25	medium
323712	Apache Tomcat 10.1.0.M1 < 10.1.56 multiple vulnerabilities	Nessus	Web Servers	2026/6/30	2026/7/14	critical
327591	SUSE SLES16: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2026:22646-1)	Nessus	SuSE Local Security Checks	2026/7/17	2026/7/17	critical
327729	SUSE SLES15: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (SUSE-SU-2026:3112-1)	Nessus	SuSE Local Security Checks	2026/7/18	2026/7/18	critical
348289	AlmaLinux 9 : tomcat (ALSA-2026:68660)	Nessus	Alma Linux Local Security Checks	2026/9/19	2026/9/25	medium
348575	RockyLinux 10 : tomcat9 (RLSA-2026:68651)	Nessus	Rocky Linux Local Security Checks	2026/9/21	2026/9/25	medium
328483	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2026-1945)	Nessus	Amazon Linux Local Security Checks	2026/7/20	2026/7/31	critical
329143	SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2026:3167-1)	Nessus	SuSE Local Security Checks	2026/7/23	2026/7/23	critical
323714	Apache Tomcat 9.0.0.M1 < 9.0.119 multiple vulnerabilities	Nessus	Web Servers	2026/6/30	2026/7/14	critical
328508	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2026-1946)	Nessus	Amazon Linux Local Security Checks	2026/7/20	2026/7/31	critical

检测

插件搜索

medium

medium

medium

critical

critical

critical

medium

medium

critical

critical

critical

critical