Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security advisories
We found 12 articles for you...
202
security advisoryimportantinput validationopenSUSE Leap 15.6 Tomcat Important Input Validation Issues 2026-0932-1
An update that solves three vulnerabilities can now be installed.. # Security update for tomcat Announcement ID: SUSE-SU-2026:0932-1 Release Date: 2026-03-19T10:27:34Z Rating: important References: * bsc#1258371 * bsc#1258385 * bsc#1258387 Cross-References: * CVE-2025-66614 * CVE-2026-24733 * CVE-2026-24734 CVSS scores: * CVE-2025-66614 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2025-66614 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2025-66614 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2025-66614 ( NVD ): 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L * CVE-2026-24733 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-24733 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-24733 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-24733 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-24734 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2026-24734 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-24734 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: * openSUSE Leap 15.6 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * Web and Scripting Module 15-SP7 An update that solves three vulnerabilities can now be installed. ## Description: This update for tomcat fixes the following issues: Update to Tomcat 9.0.115: * CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371). * CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385). * CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387). Changelog: * Catalina * Fix: 69623: Additional fix for the long standing regression that meant that calls to ClassLoader.getResource().getContent() failed when made from within a web application with resource caching enabled if the target resource was packaged in a JAR file. (markt) * Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the CsrfPreventionFilter. (schultz) * Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2 requests when the content-length header is not set. (dsoumis) * Update: Update the minimum and recommended versions for Tomcat Native to 1.3.4. (markt) * Add: Add a new ssoReauthenticationMode to the Tomcat provided Authenticators that provides a per Authenticator override of the SSO Valve requireReauthentication attribute. (markt) * Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception rather than silently using a replacement character. (markt) * Fix: 69871: Increase log level to INFO for missing configuration for the rewrite valve. (remm) * Fix: Add log warnings for additional Host appBase suspicious values. (remm) * Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar. org.apache.catalina.Connector no longer requires org.apache.tomcat.jni.AprStatus to be present. (markt) * Add: Add the ability to use a custom function to generate the client identifier in the CrawlerSessionManagerValve. This is only available programmatically. Pull request #902 by Brian Matzon. (markt) * Fix: Change the SSO reauthentication behaviour for SPNEGO authentication so that a normal SPNEGO authentication is performed if the SSL Valve is configured with reauthentication enabled. This is so that the delegated credentials will be available to the web application. (markt) * Fix: When generating the class path in the Loader, re-order the check on individual class path components to avoid a potential NullPointerException. Identified by Coverity Scan. (markt) * Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull request #915 by Joshua Rogers. (remm) * Update: Add an attribute, digestInRfc3112Order, to MessageDigestCredentialHandler to control the order in which the credential and salt are digested. By default, the current, non-RFC 3112 compliant, order of salt then credential will be used. This default will change in Tomcat 12 to the RFC 3112 compliant order of credential then salt. (markt) * Cluster * Add: 62814: Document that human-readable names maybe used for mapSendOptions and align documentation with channelSendOptions. Based on pull request #929 by archan0621. (markt) * Clustering * Fix: Correct a regression introduced in 9.0.109 that broke some clustering configurations. (markt) * Coyote * Fix: Prevent concurrent release of OpenSSLEngine resources and the termination of the Tomcat Native library as it can cause crashes during Tomcat shutdown. (markt) * Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm) * Fix: Improve warnings when setting ciphers lists in the FFM code, mirroring the tomcat-native changes. (remm) * Fix: 69910: Dereference TLS objects right after closing a socket to improve memory efficiency. (remm) * Fix: Relax the JSSE vs OpenSSLconfiguration style checks on SSLHostConfig to reflect the existing implementation that allows one configuration style to be used for the trust attributes and a different style for all the other attributes. (markt) * Fix: Better warning message when OpenSSLConf configuration elements are used with a JSSE TLS implementation. (markt) * Fix: When using OpenSSL via FFM, don't log a warning about missing CA certificates unless CA certificates were configured and the configuration failed. (markt) * Add: For configuration consistency between OpenSSL and JSSE TLS implementations, TLSv1.3 cipher suites included in the ciphers attribute of an SSLHostConfig are now always ignored (previously they would be ignored with OpenSSL implementations and used with JSSE implementations) and a warning is logged that the cipher suite has been ignored. (markt) * Add: Add the ciphersuite attribute to SSLHostConfig to configure the TLSv1.3 cipher suites. (markt) * Add: Add OCSP support to JSSE based TLS connectors and make the use of OCSP configurable per connector for both JSSE and OpenSSL based TLS implementations. Align the checks performed by OpenSSL with those performed by JSSE. (markt) * Add: Add support for soft failure of OCSP checks with soft failure support disabled by default. (markt) * Add: Add support for configuring the verification flags passed to OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt) * Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5. * Fix: Don't log an incorrect certificate KeyStore location when creating a TLS connector if the KeyStore instance has been set directly on the connector. (markt) * Fix: HTTP/0.9 only allows GET as the HTTP method. (remm) * Add: Add strictSni attribute on the Connector to allow matching the SSLHostConfig configuration associated with the SNI host name to the SSLHostConfig configuration matched from the HTTP protocol host name. Non matching configurations will cause the request to be rejected. The attribute default value is true, enabling the matching. (remm) * Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm) * Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL provider. Pull request #912 by aogburn. (markt) * Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers. * Jasper * Fix: 69333: Correct a regression in the previous fix for 69333 and ensure that reuse() or release() is always called for a tag. (markt) * Fix: 69877: Catch IllegalArgumentException when processing URIs when creating the classpath to handle invalid URIs. (remm) * Fix: Fix populating the classpath with the webapp classloader repositories. (remm) * Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some exception details. Patch submitted by Eric Blanquer. (remm) * Jdbc-pool * Fix: 64083: If the underlying connection has been closed, don't add it to the pool when it is returned. Pull request #235 by Alex Panchenko. (markt) * Web applications * Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server status output if one or more of the web applications failed to start. (schultz) * Add: Manager: Include web application state in the HTML and JSON complete server status output. (markt) * Add: Documentation: Expand the documentation to better explain when OCSP is supported and when it is not. (markt) * Websocket * Fix: 69920: When attempting to write to a closed Writer or OutputStream obtained from a WebSocket session, throw an IOException rather than an IllegalStateExcpetion as required by Writer and strongly suggested by OutputStream. (markt) * Other * Add: Add property "gpg.sign.files" to optionally disable release artefact signing with GPG. (rjung) * Add: Add test.silent property to suppress JUnit console output during test execution. Useful for cleaner console output when runningtests with multiple threads. (csutherl) * Update: Update the internal fork of Commons Pool to 2.13.1. (markt) * Update: Update the internal fork of Commons DBCP to 2.14.0. (markt) * Update: Update Commons Daemon to 1.5.1. (markt) * Update: Update ByteBuddy to 1.18.3. (markt) * Update: Update UnboundID to 7.0.4. (markt) * Update: Update Checkstyle to 12.3.1. (markt) * Add: Improvements to French translations. (markt) * Add: Improvements to Japanese translations provided by tak7iji. (markt) * Add: Improvements to Chinese translations provided by Yang. vincent.h and yong hu. (markt) * Update: Update Tomcat Native to 1.3.5. (markt) * Add: Add test profile system for selective test execution. Profiles can be specified via -Dtest.profile= to run specific test subsets without using patterns directly. Profile patterns are defined in test- profiles.properties. (csutherl) * Update: Update file extension to media type mappings to align with the current list used by the Apache Web Server (httpd). (markt) * Update: Update Commons Daemon to 1.5.0. (markt) * Update: Update Byte Buddy to 1.18.2. (markt) * Update: Update Checkstyle to 12.2.0. (markt) * Add: Improvements to Spanish translations provided by White Vogel. (markt) * Add: Improvements to French translations. (remm) * Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt) * Update: Update to Byte Buddy 1.17.8. (markt) * Update: Update to Checkstyle 12.1.1. (markt) * Update: Update to Jacoco 0.8.14. (markt) * Update: Update to SpotBugs 4.9.8. (markt) * Update: Update to JSign 7.4. (markt) * Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-932=1 * Web and Scripting Module 15-SP7 zypper in-t patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-932=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-932=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-932=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-932=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-932=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-932=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-932=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-932=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-932=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-932=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-932=1 ## Package List: * openSUSE Leap 15.6 (noarch) * tomcat-embed-9.0.115-150200.102.1 * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-javadoc-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-jsvc-9.0.115-150200.102.1 * tomcat-docs-webapp-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * Web and Scripting Module 15-SP7 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 *tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSELinux Enterprise Server 15 SP5 LTSS (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch) * tomcat-el-3_0-api-9.0.115-150200.102.1 * tomcat-lib-9.0.115-150200.102.1 * tomcat-webapps-9.0.115-150200.102.1 * tomcat-9.0.115-150200.102.1 * tomcat-jsp-2_3-api-9.0.115-150200.102.1 * tomcat-servlet-4_0-api-9.0.115-150200.102.1 * tomcat-admin-webapps-9.0.115-150200.102.1 ## References: * https://www.suse.com/security/cve/CVE-2025-66614.html * https://www.suse.com/security/cve/CVE-2026-24733.html * https://www.suse.com/security/cve/CVE-2026-24734.html *https://bugzilla.suse.com/show_bug.cgi?id=1258371 * https://bugzilla.suse.com/show_bug.cgi?id=1258385 * https://bugzilla.suse.com/show_bug.cgi?id=1258387 . Update for openSUSE includes three important vulnerabilities in Tomcat with guidance for installation.. openSUSE tomcat patch update vulnerabilities. . Severity: Important. LinuxSecurity.com Team
Mar 19, 2026
•Important
OpenSUSE
202
security advisoryimportantOpenSUSEopenSUSE 2026-0890-1 Important Security Fixes for Tomcat10 Released
An update that solves three vulnerabilities can now be installed.. # Security update for tomcat10 Announcement ID: SUSE-SU-2026:0890-1 Release Date: 2026-03-13T08:57:31Z Rating: important References: * bsc#1258371 * bsc#1258385 * bsc#1258387 Cross-References: * CVE-2025-66614 * CVE-2026-24733 * CVE-2026-24734 CVSS scores: * CVE-2025-66614 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2025-66614 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2025-66614 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2025-66614 ( NVD ): 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L * CVE-2026-24733 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-24733 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-24733 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-24733 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-24734 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2026-24734 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-24734 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: * openSUSE Leap 15.6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * Web and Scripting Module 15-SP7 An update that solves three vulnerabilities can now be installed. ## Description: This update fortomcat10 fixes the following issues: Update to Tomcat 10.1.52: * CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371). * CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385). * CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387). Changelog: * Catalina * Fix: 69623: Additional fix for the long standing regression that meant that calls to ClassLoader.getResource().getContent() failed when made from within a web application with resource caching enabled if the target resource was packaged in a JAR file. (markt) * Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the CsrfPreventionFilter. (schultz) * Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2 requests when the content-length header is not set. (dsoumis) * Update: Enable minimum and recommended Tomcat Native versions to be set separately for Tomcat Native 1.x and 2.x. Update the minimum and recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum and recommended versions for Tomcat Native 2.x to 2.0.12. (markt) * Add: Add a new ssoReauthenticationMode to the Tomcat provided Authenticators that provides a per Authenticator override of the SSO Valve requireReauthentication attribute. (markt) * Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception rather than silently using a replacement character. (markt) * Fix: 69932: Fix request end access log pattern regression, which would log the start time of the request instead. (remm) * Fix: 69871: Increase log level to INFO for missing configuration for the rewrite valve. (remm) * Fix: Add log warnings for additional Host appBase suspicious values. (remm) * Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar. org.apache.catalina.Connector no longer requires org.apache.tomcat.jni.AprStatus to be present. (markt) *Add: Add the ability to use a custom function to generate the client identifier in the CrawlerSessionManagerValve. This is only available programmatically. Pull request #902 by Brian Matzon. (markt) * Fix: Change the SSO reauthentication behaviour for SPNEGO authentication so that a normal SPNEGO authentication is performed if the SSL Valve is configured with reauthentication enabled. This is so that the delegated credentials will be available to the web application. (markt) * Fix: When generating the class path in the Loader, re-order the check on individual class path components to avoid a potential NullPointerException. Identified by Coverity Scan. (markt) * Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull request #915 by Joshua Rogers. (remm) * Update: Add an attribute, digestInRfc3112Order, to MessageDigestCredentialHandler to control the order in which the credential and salt are digested. By default, the current, non-RFC 3112 compliant, order of salt then credential will be used. This default will change in Tomcat 12 to the RFC 3112 compliant order of credential then salt. (markt) * Fix: Log warnings when the SSO configuration does not comply with the documentation. (remm) * Update: Deprecate the RemoteAddrFilter and RemoteAddrValve in favour of the RemoteCIDRFilter and RemoteCIDRValve. (markt) * Fix: 69837: Fix corruption of the class path generated by the Loader when running on Windows. (markt) * Fix: Reject requests that map to invalid Windows file names earlier. (markt) * Fix: 69839: Ensure that changes to session IDs (typically after authentication) are promulgated to the SSO Valve to ensure that SSO entries are fully clean-up on session expiration. Patch provided by Kim Johan Andersson. (markt) * Fix: Fix a race condition in the creation of the storage location for the FileStore. (markt) * Cluster * Add: 62814: Document that human-readable names may be used for mapSendOptions and align documentation with channelSendOptions. Based on pull request #929 by archan0621. (markt) * Clustering * Fix: Correct a regression introduced in 10.1.45 that broke some clustering configurations. (markt) * Coyote * Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown that triggered a significant memory leak. Patch provided by Wes. (markt) * Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm) * Fix: Improve warnings when setting ciphers lists in the FFM code, mirroring the tomcat-native changes. (remm) * Fix: 69910: Dereference TLS objects right after closing a socket to improve memory efficiency. (remm) * Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig to reflect the existing implementation that allows one configuration style to be used for the trust attributes and a different style for all the other attributes. (markt) * Fix: Better warning message when OpenSSLConf configuration elements are used with a JSSE TLS implementation. (markt) * Fix: When using OpenSSL via FFM, don't log a warning about missing CA certificates unless CA certificates were configured and the configuration failed. (markt) * Add: For configuration consistency between OpenSSL and JSSE TLS implementations, TLSv1.3 cipher suites included in the ciphers attribute of an SSLHostConfig are now always ignored (previously they would be ignored with OpenSSL implementations and used with JSSE implementations) and a warning is logged that the cipher suite has been ignored. (markt) * Add: Add the ciphersuite attribute to SSLHostConfig to configure the TLSv1.3 cipher suites. (markt) * Add: Add OCSP support to JSSE based TLS connectors and make the use of OCSP configurable per connector for both JSSE and OpenSSL based TLS implementations. Align the checks performed by OpenSSL with those performed by JSSE. (markt) * Add: Add support for soft failure of OCSPchecks with soft failure support disabled by default. (markt) * Add: Add support for configuring the verification flags passed to OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt) * Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5. * Fix: Prevent concurrent release of OpenSSLEngine resources and the termination of the Tomcat Native library as it can cause crashes during Tomcat shutdown. (markt) * Fix: Don't log an incorrect certificate KeyStore location when creating a TLS connector if the KeyStore instance has been set directly on the connector. (markt) * Fix: HTTP/0.9 only allows GET as the HTTP method. (remm) * Add: Add strictSni attribute on the Connector to allow matching the SSLHostConfig configuration associated with the SNI host name to the SSLHostConfig configuration matched from the HTTP protocol host name. Non matching configurations will cause the request to be rejected. The attribute default value is true, enabling the matching. (remm) * Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm) * Fix: Fix use of deferAccept attribute in JMX, since it is normally only removed in Tomcat 11. (remm) * Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL provider. Pull request #912 by aogburn. (markt) * Fix: Fix potential crash on shutdown when a Connector depends on the Tomcat Native library. (markt) * Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers. * Fix: 69848: Fix copy/paste errors in 10.1.47 that meant DELETE requests received via the AJP connector were processed as OPTIONS requests and PROPFIND requests were processed as TRACE. (markt) * Fix: Various OCSP processing issues in the OpenSSL FFM code. (dsoumis) * General * Add: Add test.silent property to suppress JUnit console output during test execution. Useful for cleaner console output when running tests with multiple threads. (csutherl) * Jasper *Fix: 69333: Correct a regression in the previous fix for 69333 and ensure that reuse() or release() is always called for a tag. (markt) * Fix: 69877: Catch IllegalArgumentException when processing URIs when creating the classpath to handle invalid URIs. (remm) * Fix: Fix populating the classpath with the webapp classloader repositories. (remm) * Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some exception details. Patch submitted by Eric Blanquer. (remm) * Jdbc-pool * Fix: 64083: If the underlying connection has been closed, don't add it to the pool when it is returned. Pull request #235 by Alex Panchenko. (markt) * Web applications * Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server status output if one or more of the web applications failed to start. (schultz) * Add: Manager: Include web application state in the HTML and JSON complete server status output. (markt) * Add: Documentation: Expand the documentation to better explain when OCSP is supported and when it is not. (markt) * Websocket * Fix: 69920: When attempting to write to a closed Writer or OutputStream obtained from a WebSocket session, throw an IOException rather than an IllegalStateExcpetion as required by Writer and strongly suggested by OutputStream. (markt) * Fix: 69845: When using permessage-deflate with Java 25 onwards, handle the underlying Inflater and/or Deflater throwing IllegalStateException when closed rather than NullPointerException as they do in Java 24 and earlier. * Other * Update: Update the internal fork of Commons Pool to 2.13.1. (markt) * Update: Update the internal fork of Commons DBCP to 2.14.0. (markt) * Update: Update Commons Daemon to 1.5.1. (markt) * Update: Update ByteBuddy to 1.18.3. (markt) * Update: Update UnboundID to 7.0.4. (markt) * Update: Update Checkstyle to 12.3.1. (markt) * Add: Improvements to French translations. (markt) * Add: Improvements to Japanese translationsprovided by tak7iji. (markt) * Add: Improvements to Chinese translations provided by Yang. vincent.h and yong hu. (markt) * Update: Update Tomcat Native to 2.0.12. (markt) * Add: Add property "gpg.sign.files" to optionally disable release artefact signing with GPG. (rjung) * Add: Add test profile system for selective test execution. Profiles can be specified via -Dtest.profile= to run specific test subsets without using patterns directly. Profile patterns are defined in test- profiles.properties. (csutherl) * Update: Update file extension to media type mappings to align with the current list used by the Apache Web Server (httpd). (markt) * Update: Update the packaged version of the Tomcat Migration Tool for Jakarta EE to 1.0.10. (markt) * Update: Update Commons Daemon to 1.5.0. (markt) * Update: Update Byte Buddy to 1.18.2. (markt) * Update: Update Checkstyle to 12.2.0. (markt) * Add: Improvements to Spanish translations provided by White Vogel. (markt) * Add: Improvements to French translations. (remm) * Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt) * Update: Update to Byte Buddy 1.17.8. (markt) * Update: Update to Checkstyle 12.1.1. (markt) * Update: Update to Jacoco 0.8.14. (markt) * Update: Update to SpotBugs 4.9.8. (markt) * Update: Update to JSign 7.4. (markt) * Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-890=1 * Web and Scripting Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-890=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-890=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-890=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-890=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-890=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-890=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-890=1 ## Package List: * openSUSE Leap 15.6 (noarch) * tomcat10-jsvc-10.1.52-150200.5.61.1 * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-docs-webapp-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-doc-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-embed-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * Web and Scripting Module 15-SP7 (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 *tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 ## References: * https://www.suse.com/security/cve/CVE-2025-66614.html * https://www.suse.com/security/cve/CVE-2026-24733.html * https://www.suse.com/security/cve/CVE-2026-24734.html * https://bugzilla.suse.com/show_bug.cgi?id=1258371 *https://bugzilla.suse.com/show_bug.cgi?id=1258385 * https://bugzilla.suse.com/show_bug.cgi?id=1258387 . Tomcat 10 update on openSUSE addresses three important issues including client certificate validation bypass and more.. openSUSE Tomcat 10 update security certificate bypass HTTP requests. . Severity: Important. LinuxSecurity.com Team
Mar 13, 2026
•Important
OpenSUSE
100
security advisorySuSEimportantSUSE Tomcat 10 Important Security Fixes CVE-2025-66614 2026-0890-1
An update that solves three vulnerabilities can now be installed.. # Security update for tomcat10 Announcement ID: SUSE-SU-2026:0890-1 Release Date: 2026-03-13T08:57:31Z Rating: important References: * bsc#1258371 * bsc#1258385 * bsc#1258387 Cross-References: * CVE-2025-66614 * CVE-2026-24733 * CVE-2026-24734 CVSS scores: * CVE-2025-66614 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2025-66614 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2025-66614 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2025-66614 ( NVD ): 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L * CVE-2026-24733 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-24733 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-24733 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-24733 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-24734 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2026-24734 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-24734 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: * openSUSE Leap 15.6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * Web and Scripting Module 15-SP7 An update that solves three vulnerabilities can now be installed. ## Description: This update fortomcat10 fixes the following issues: Update to Tomcat 10.1.52: * CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371). * CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385). * CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387). Changelog: * Catalina * Fix: 69623: Additional fix for the long standing regression that meant that calls to ClassLoader.getResource().getContent() failed when made from within a web application with resource caching enabled if the target resource was packaged in a JAR file. (markt) * Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the CsrfPreventionFilter. (schultz) * Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2 requests when the content-length header is not set. (dsoumis) * Update: Enable minimum and recommended Tomcat Native versions to be set separately for Tomcat Native 1.x and 2.x. Update the minimum and recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum and recommended versions for Tomcat Native 2.x to 2.0.12. (markt) * Add: Add a new ssoReauthenticationMode to the Tomcat provided Authenticators that provides a per Authenticator override of the SSO Valve requireReauthentication attribute. (markt) * Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception rather than silently using a replacement character. (markt) * Fix: 69932: Fix request end access log pattern regression, which would log the start time of the request instead. (remm) * Fix: 69871: Increase log level to INFO for missing configuration for the rewrite valve. (remm) * Fix: Add log warnings for additional Host appBase suspicious values. (remm) * Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar. org.apache.catalina.Connector no longer requires org.apache.tomcat.jni.AprStatus to be present. (markt) *Add: Add the ability to use a custom function to generate the client identifier in the CrawlerSessionManagerValve. This is only available programmatically. Pull request #902 by Brian Matzon. (markt) * Fix: Change the SSO reauthentication behaviour for SPNEGO authentication so that a normal SPNEGO authentication is performed if the SSL Valve is configured with reauthentication enabled. This is so that the delegated credentials will be available to the web application. (markt) * Fix: When generating the class path in the Loader, re-order the check on individual class path components to avoid a potential NullPointerException. Identified by Coverity Scan. (markt) * Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull request #915 by Joshua Rogers. (remm) * Update: Add an attribute, digestInRfc3112Order, to MessageDigestCredentialHandler to control the order in which the credential and salt are digested. By default, the current, non-RFC 3112 compliant, order of salt then credential will be used. This default will change in Tomcat 12 to the RFC 3112 compliant order of credential then salt. (markt) * Fix: Log warnings when the SSO configuration does not comply with the documentation. (remm) * Update: Deprecate the RemoteAddrFilter and RemoteAddrValve in favour of the RemoteCIDRFilter and RemoteCIDRValve. (markt) * Fix: 69837: Fix corruption of the class path generated by the Loader when running on Windows. (markt) * Fix: Reject requests that map to invalid Windows file names earlier. (markt) * Fix: 69839: Ensure that changes to session IDs (typically after authentication) are promulgated to the SSO Valve to ensure that SSO entries are fully clean-up on session expiration. Patch provided by Kim Johan Andersson. (markt) * Fix: Fix a race condition in the creation of the storage location for the FileStore. (markt) * Cluster * Add: 62814: Document that human-readable names may be used for mapSendOptions and align documentation with channelSendOptions. Based on pull request #929 by archan0621. (markt) * Clustering * Fix: Correct a regression introduced in 10.1.45 that broke some clustering configurations. (markt) * Coyote * Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown that triggered a significant memory leak. Patch provided by Wes. (markt) * Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm) * Fix: Improve warnings when setting ciphers lists in the FFM code, mirroring the tomcat-native changes. (remm) * Fix: 69910: Dereference TLS objects right after closing a socket to improve memory efficiency. (remm) * Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig to reflect the existing implementation that allows one configuration style to be used for the trust attributes and a different style for all the other attributes. (markt) * Fix: Better warning message when OpenSSLConf configuration elements are used with a JSSE TLS implementation. (markt) * Fix: When using OpenSSL via FFM, don't log a warning about missing CA certificates unless CA certificates were configured and the configuration failed. (markt) * Add: For configuration consistency between OpenSSL and JSSE TLS implementations, TLSv1.3 cipher suites included in the ciphers attribute of an SSLHostConfig are now always ignored (previously they would be ignored with OpenSSL implementations and used with JSSE implementations) and a warning is logged that the cipher suite has been ignored. (markt) * Add: Add the ciphersuite attribute to SSLHostConfig to configure the TLSv1.3 cipher suites. (markt) * Add: Add OCSP support to JSSE based TLS connectors and make the use of OCSP configurable per connector for both JSSE and OpenSSL based TLS implementations. Align the checks performed by OpenSSL with those performed by JSSE. (markt) * Add: Add support for soft failure of OCSPchecks with soft failure support disabled by default. (markt) * Add: Add support for configuring the verification flags passed to OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt) * Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5. * Fix: Prevent concurrent release of OpenSSLEngine resources and the termination of the Tomcat Native library as it can cause crashes during Tomcat shutdown. (markt) * Fix: Don't log an incorrect certificate KeyStore location when creating a TLS connector if the KeyStore instance has been set directly on the connector. (markt) * Fix: HTTP/0.9 only allows GET as the HTTP method. (remm) * Add: Add strictSni attribute on the Connector to allow matching the SSLHostConfig configuration associated with the SNI host name to the SSLHostConfig configuration matched from the HTTP protocol host name. Non matching configurations will cause the request to be rejected. The attribute default value is true, enabling the matching. (remm) * Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm) * Fix: Fix use of deferAccept attribute in JMX, since it is normally only removed in Tomcat 11. (remm) * Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL provider. Pull request #912 by aogburn. (markt) * Fix: Fix potential crash on shutdown when a Connector depends on the Tomcat Native library. (markt) * Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers. * Fix: 69848: Fix copy/paste errors in 10.1.47 that meant DELETE requests received via the AJP connector were processed as OPTIONS requests and PROPFIND requests were processed as TRACE. (markt) * Fix: Various OCSP processing issues in the OpenSSL FFM code. (dsoumis) * General * Add: Add test.silent property to suppress JUnit console output during test execution. Useful for cleaner console output when running tests with multiple threads. (csutherl) * Jasper *Fix: 69333: Correct a regression in the previous fix for 69333 and ensure that reuse() or release() is always called for a tag. (markt) * Fix: 69877: Catch IllegalArgumentException when processing URIs when creating the classpath to handle invalid URIs. (remm) * Fix: Fix populating the classpath with the webapp classloader repositories. (remm) * Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some exception details. Patch submitted by Eric Blanquer. (remm) * Jdbc-pool * Fix: 64083: If the underlying connection has been closed, don't add it to the pool when it is returned. Pull request #235 by Alex Panchenko. (markt) * Web applications * Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server status output if one or more of the web applications failed to start. (schultz) * Add: Manager: Include web application state in the HTML and JSON complete server status output. (markt) * Add: Documentation: Expand the documentation to better explain when OCSP is supported and when it is not. (markt) * Websocket * Fix: 69920: When attempting to write to a closed Writer or OutputStream obtained from a WebSocket session, throw an IOException rather than an IllegalStateExcpetion as required by Writer and strongly suggested by OutputStream. (markt) * Fix: 69845: When using permessage-deflate with Java 25 onwards, handle the underlying Inflater and/or Deflater throwing IllegalStateException when closed rather than NullPointerException as they do in Java 24 and earlier. * Other * Update: Update the internal fork of Commons Pool to 2.13.1. (markt) * Update: Update the internal fork of Commons DBCP to 2.14.0. (markt) * Update: Update Commons Daemon to 1.5.1. (markt) * Update: Update ByteBuddy to 1.18.3. (markt) * Update: Update UnboundID to 7.0.4. (markt) * Update: Update Checkstyle to 12.3.1. (markt) * Add: Improvements to French translations. (markt) * Add: Improvements to Japanese translationsprovided by tak7iji. (markt) * Add: Improvements to Chinese translations provided by Yang. vincent.h and yong hu. (markt) * Update: Update Tomcat Native to 2.0.12. (markt) * Add: Add property "gpg.sign.files" to optionally disable release artefact signing with GPG. (rjung) * Add: Add test profile system for selective test execution. Profiles can be specified via -Dtest.profile= to run specific test subsets without using patterns directly. Profile patterns are defined in test- profiles.properties. (csutherl) * Update: Update file extension to media type mappings to align with the current list used by the Apache Web Server (httpd). (markt) * Update: Update the packaged version of the Tomcat Migration Tool for Jakarta EE to 1.0.10. (markt) * Update: Update Commons Daemon to 1.5.0. (markt) * Update: Update Byte Buddy to 1.18.2. (markt) * Update: Update Checkstyle to 12.2.0. (markt) * Add: Improvements to Spanish translations provided by White Vogel. (markt) * Add: Improvements to French translations. (remm) * Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt) * Update: Update to Byte Buddy 1.17.8. (markt) * Update: Update to Checkstyle 12.1.1. (markt) * Update: Update to Jacoco 0.8.14. (markt) * Update: Update to SpotBugs 4.9.8. (markt) * Update: Update to JSign 7.4. (markt) * Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-890=1 * Web and Scripting Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-890=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-890=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-890=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-890=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-890=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-890=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-890=1 ## Package List: * openSUSE Leap 15.6 (noarch) * tomcat10-jsvc-10.1.52-150200.5.61.1 * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-docs-webapp-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-doc-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-embed-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * Web and Scripting Module 15-SP7 (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 *tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch) * tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1 * tomcat10-lib-10.1.52-150200.5.61.1 * tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1 * tomcat10-admin-webapps-10.1.52-150200.5.61.1 * tomcat10-10.1.52-150200.5.61.1 * tomcat10-webapps-10.1.52-150200.5.61.1 * tomcat10-el-5_0-api-10.1.52-150200.5.61.1 ## References: * https://www.suse.com/security/cve/CVE-2025-66614.html * https://www.suse.com/security/cve/CVE-2026-24733.html * https://www.suse.com/security/cve/CVE-2026-24734.html * https://bugzilla.suse.com/show_bug.cgi?id=1258371 *https://bugzilla.suse.com/show_bug.cgi?id=1258385 * https://bugzilla.suse.com/show_bug.cgi?id=1258387 . SUSE Tomcat 10 update resolves critical client verification bypass with essential fixes. Install the patch to secure systems.. SUSE Security Update, Tomcat Certificate Bypass, Important Patch, Client Verification, Tomcat Vulnerabilities. . Severity: Important. LinuxSecurity.com Team
Mar 13, 2026
•Important
SuSE
198
security advisoryinformation disclosuremediumArchLinux: ASA-202506-4 medium risk of go certificate bypass issue
The package go before version 1.24.4-1 is vulnerable to multiple issues including certificate verification bypass and information disclosure. . Arch Linux Security Advisory ASA-202506-4 ========================================= Severity: Medium Date : 2025-06-07 CVE-ID : CVE-2025-4673 CVE-2025-22874 Package : go Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2896 Summary ======= The package go before version 1.24.4-1 is vulnerable to multiple issues including certificate verification bypass and information disclosure. Resolution ========== Upgrade to 1.24.4-1. # pacman -Syu "go> =1.24.4-1" The problems have been fixed upstream in version 1.24.4. Workaround ========== None. Description =========== - CVE-2025-4673 (information disclosure) net/http: Proxy-Authorization and Proxy-Authenticate headers were not cleared during cross-origin redirects, potentially leaking sensitive credentials in proxy-authenticated environments. - CVE-2025-22874 (certificate verification bypass) crypto/x509: When VerifyOptions.KeyUsages includes ExtKeyUsageAny, certificate policy validation is unintentionally disabled. This affects certificate chains with policy constraints, which are uncommon but security-relevant when used. Impact ====== A remote attacker can exploit Go's HTTP client to leak proxy credentials via cross-origin redirects, or bypass certificate policy validation when ExtKeyUsageAny is used during TLS verification. References ========== https://github.com/golang/go/issues/73816 https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A/m/XDxq7uidAgAJ https://go.dev/doc/devel/release#go1.24.4 https://github.com/golang/go/issues/73612 https://security.archlinux.org/CVE-2025-4673 https://security.archlinux.org/CVE-2025-22874 . Arch Linux Security Advisory ASA-202507-5 with high severity highlights various vulnerabilities in the ruby package.. Arch Linux, package security, go programming, certificateissues, CVE-2025-4673. . Severity: Medium. LinuxSecurity.com Team
Jun 13, 2025
•Medium
ArchLinux
197
security advisoryDebianmemory issueDebian LTS: DLA-4091-1: nginx Security Advisory Updates
This upload fixes two security issues in the version of nginx shipped in bullseye. CVE-2024-7347 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4091-1
Mar 25, 2025
•Critical
Debian LTS
87
security advisorycriticaldebianDebian: DSA-5170-1 Critical Node.js Update, HTTP Request Smuggling Fix
Multiple vulnerabilities were discovered in Node.js, which could result in HTTP request smuggling, a bypass of certificate verification or prototype pollution. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5170-1
Jun 27, 2022
•Critical
Debian
198
security advisoryhigh severityArch LinuxArch Linux: ASA-202108-8 High: Fossil Certificate Bypass Threat
The package fossil before version 2.16-1 is vulnerable to certificate verification bypass. . Arch Linux Security Advisory ASA-202108-8 ======================================== Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-36377 Package : fossil Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-2146 Summary ====== The package fossil before version 2.16-1 is vulnerable to certificate verification bypass. Resolution ========= Upgrade to 2.16-1. # pacman -Syu "fossil> =2.16-1" The problem has been fixed upstream in version 2.16. Workaround ========= None. Description ========== Fossil before version 2.15.2 often skips the hostname check during TLS certificate validation. Impact ===== A man-in-the-middle attacker could spoof a Fossil repository by presenting any valid certificate for an arbitrary hostname, leading to potential information disclosure. References ========= https://fossil-scm.org/forum/forumpost/8d367e16f53d93c789d70bd3bf2c9587227bbd5c6a7b8e512cccd79007536036 https://fossil-scm.org/home/info/aaab2a15d1dfc22f5453c2bad8f25ecf518ed3eef9a7fa6f4c5bd69ab4e4b075 https://security.archlinux.org/CVE-2021-36377 . Debian Security Bulletin DSA-2021-4567 highlights a severe vulnerability in libxml2 prior to version 2.9.10 that could lead to XML entity expansion.. Fossil Certificate Bypass, Arch Linux Security, Package Advisory. . LinuxSecurity.com Team
Aug 13, 2021
ArchLinux
198
security advisorysecurity issuemedium severityUbuntu Security Notice: USN-5467-1 Medium: Keycloak Certificate Issue
The package keycloak before version 14.0.0-1 is vulnerable to certificate verification bypass. . Arch Linux Security Advisory ASA-202106-53 ========================================= Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2020-35509 Package : keycloak Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-2084 Summary ====== The package keycloak before version 14.0.0-1 is vulnerable to certificate verification bypass. Resolution ========= Upgrade to 14.0.0-1. # pacman -Syu "keycloak> =14.0.0-1" The problem has been fixed upstream in version 14.0.0. Workaround ========= None. Description ========== A security issue has been found in Keycloak before version 14.0.0. Depending on the webserver configuration, a malicious user can supply an expired certificate and it would be accepted by Keycloak direct- grant authenticator. This is because Keycloak does not trigger the appropriate timestamp validation. Impact ===== A user could authenticate with an expired certificate. References ========= https://bugzilla.redhat.com/show_bug.cgi?id=1912427 https://github.com/keycloak/keycloak/pull/8067 https://github.com/keycloak/keycloak/commit/478319348bdfdb9b6d39122f41edf2af79f679bb https://security.archlinux.org/CVE-2020-35509 . Arch Linux Security Advisory ASA-202112-14: Piwigo at risk of SQL injection, update to 12.1.0-2 advised.. Keycloak Certificate Bypass, Arch Linux Security Advisory, Medium Severity Keycloak Issue. . Severity: Medium. LinuxSecurity.com Team
Jun 24, 2021
•Medium
ArchLinux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!