The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:92862 advisory.

    * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
      * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag     processing (CVE-2026-65927)
      * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)
      * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator     (CVE-2026-65905)
      * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)
      * tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)


    Bug Fix(es) and Enhancement(s):

      * Stalled TLS handshake when the server's first flight is too large [rhel-10] (JIRA:RHEL-264918)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788353293 advisory.

  - Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security     constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for     a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1     through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
    Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
    (CVE-2026-65182)

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain     sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache     Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120. Users     are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue. (CVE-2026-65183)

  - Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before     windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the     upper boundary of the replay window then that request is replayable once only while the associated     nonceCount remains within the replay window. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at     the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through     7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.25, 10.1.58 or 9.0.121, which fix the issue. (CVE-2026-65905)

  - Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes     rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache     Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The     following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to     version 11.0.25, 10.1.58 or 9.0.121 which fix the issue. (CVE-2026-65927)

  - Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being     incorrectly used as role aliases within the Realm in additional to the correct usage with     Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1     through 10.1.57, from 9.0.25 through 9.0.120. The following versions were EOL at the time the CVE was     created but are known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other     unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or     9.0.121, which fix the issue. (CVE-2026-66422)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92863 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)

    * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing     (CVE-2026-65927)

    * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)

    * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator     (CVE-2026-65905)

    * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)

    * tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)

    Bug Fix(es) and Enhancement(s):

    * Stalled TLS handshake when the server's first flight is too large [rhel-10.0] (JIRA:RHEL-279019)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4203-1 advisory.

    - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint (bsc#1276893).
    - CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets     (bsc#1276894).
    - CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - fix incomplete     (bsc#1276895).
    - CVE-2026-65905: Apache Tomcat: Limited replay attack possible with DIGEST authentication (bsc#1276896).
    - CVE-2026-65927: Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access     control       (bsc#1276897).
    - CVE-2026-66299: memory exhaustion via maliciously slow clients due to the WebSocket chat example     providing an       unbounded buffer for undelivered messages (bsc#1273150).
    - CVE-2026-66422: Apache Tomcat: Servlet role references can bypass declarative role constraints     (bsc#1276898).
    - CVE-2026-68525: Apache Tomcat: Redirect after FORM auth may bypass method specific constraints     (bsc#1276899).
    - CVE-2026-68569: Apache Tomcat: Principal lookup can fail open in some cases (bsc#1276900).
    - CVE-2026-68763: Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset       (bsc#1276901).
    - CVE-2026-73180: Apache Tomcat: Authenticated WebSocket session survives end of HTTP session     (bsc#1276902).

    Changes for tomcat:

    - Updated to version 9.0.121

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92872 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)

    * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing     (CVE-2026-65927)

    * tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI     validation (CVE-2026-65637)

    * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)

    * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator     (CVE-2026-65905)

    * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)

    * tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92870 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)

    * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing     (CVE-2026-65927)

    * tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI     validation (CVE-2026-65637)

    * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)

    * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator     (CVE-2026-65905)

    * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)

    * tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92871 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)

    * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing     (CVE-2026-65927)

    * tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI     validation (CVE-2026-65637)

    * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)

    * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator     (CVE-2026-65905)

    * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)

    * tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.121. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.121_security-9 advisory.

  - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue     affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through     9.0.120. Users who have followed the security guidance to remove the examples web application are not     affected by this issue. Users are recommended to remove the examples web application or to upgrade to     version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue. (CVE-2026-66299)

  - Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an     authenticated HTTP session was changed after a WebSocket connection had been established under that     authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket     specification when the HTTP session ended. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at     the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through     7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.25, 10.1.58 or 9.0.121, which fix the issue. (CVE-2026-73180)

  - Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2     backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24,     from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at the time     the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions     may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix     the issue. (CVE-2026-68763)

  - Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT,     SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This     issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1     through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be     affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-68569)

  - Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing     of a security constraint that limits user has access to a resource POST but not GET. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through     9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected:
    from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.
    (CVE-2026-68525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:98523 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)

    * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing     (CVE-2026-65927)

    * tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI     validation (CVE-2026-65637)

    * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)

    * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator     (CVE-2026-65905)

    * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)

    * tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-92862 advisory.

    - Resolves: RHEL-255786       tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
    - Resolves: RHEL-271888       tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905)
    - Resolves: RHEL-271766       tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing     (CVE-2026-65927)
    - Resolves: RHEL-271791       tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)
    - Resolves: RHEL-271741       tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93469 advisory.

    - Resolves: RHEL-255800       tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
    - Resolves:
      tomcat: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183)
    - Resolves: RHEL-271827       tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation     (CVE-2026-65637)
    - Resolves: RHEL-271903       tomcat: Limited replay attack possible with DIGEST authentication (CVE-2026-65905)
    - Resolves: RHEL-271776       tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing     (CVE-2026-65927)
    - Resolves:
      tomcat: DoS in WebSocket chat example (CVE-2026-66299)
    - Resolves:
      tomcat: Servlet role references can bypass declarative role constraints (CVE-2026-66422)
    - Resolves: RHEL-271800       tomcat: Unauthorized resource access via FORM authentication bypass(CVE-2026-68525)
    - Resolves: RHEL-271810       tomcat: Principal lookup could fail open in some cases (CVE-2026-68569)
    - Resolves: RHEL-271732       tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
378136	AlmaLinux 10 : tomcat (ALSA-2026:92862)	Nessus	Alma Linux Local Security Checks	2026/11/10	2026/11/10	critical
360192	Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788353293)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
373951	RHEL 10 : tomcat (RHSA-2026:92863)	Nessus	Red Hat Local Security Checks	2026/10/30	2026/10/30	critical
346796	SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / etc (SUSE-SU-2026:4203-1)	Nessus	SuSE Local Security Checks	2026/9/17	2026/9/17	medium
373946	RHEL 9 : tomcat (RHSA-2026:92872)	Nessus	Red Hat Local Security Checks	2026/10/30	2026/10/30	critical
373954	RHEL 9 : tomcat (RHSA-2026:92870)	Nessus	Red Hat Local Security Checks	2026/10/30	2026/10/30	critical
373979	RHEL 9 : tomcat (RHSA-2026:92871)	Nessus	Red Hat Local Security Checks	2026/10/30	2026/10/30	critical
330442	Apache Tomcat 9.0.0.M1 < 9.0.121 multiple vulnerabilities	Nessus	Web Servers	2026/7/28	2026/8/31	medium
378894	RHEL 9 : tomcat (RHSA-2026:98523)	Nessus	Red Hat Local Security Checks	2026/11/11	2026/11/11	critical
374271	Oracle Linux 10 : tomcat (ELSA-2026-92862)	Nessus	Oracle Linux Local Security Checks	2026/10/30	2026/10/30	critical
375179	Oracle Linux 9 : tomcat (ELSA-2026-93469)	Nessus	Oracle Linux Local Security Checks	2026/11/2	2026/11/2	critical

检测

插件搜索

critical

critical

critical

medium

critical

critical

critical

medium

critical

critical

critical