Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
202
security advisoryimportanttomcatopenSUSE Leap 16.0 Tomcat Important Security Fix for Request Smuggling
An update that solves 11 vulnerabilities and has 9 bug fixes can now be installed.. openSUSE security update: security update for tomcat ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20611-1 Rating: important References: * bsc#1258371 * bsc#1261850 * bsc#1261851 * bsc#1261852 * bsc#1261853 * bsc#1261854 * bsc#1261855 * bsc#1261856 * bsc#1261857 Cross-References: * CVE-2025-66614 * CVE-2026-24880 * CVE-2026-25854 * CVE-2026-29129 * CVE-2026-29145 * CVE-2026-29146 * CVE-2026-32990 * CVE-2026-34483 * CVE-2026-34486 * CVE-2026-34487 * CVE-2026-34500 CVSS scores: * CVE-2025-66614 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2025-66614 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-24880 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-24880 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-25854 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-25854 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-29129 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-29129 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-29145 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-29145 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-29146 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-29146 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-34483 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-34483 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-34486 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34486 ( SUSE ): 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-34487 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34487 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-34500 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-34500 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 11 vulnerabilities and has 9 bug fixes can now be installed. Description: This update for tomcat fixes the following issues: - CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850). - CVE-2026-25854: Occasionally open redirect (bsc#1261851). - CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852). - CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853). - CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854). - CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855). - CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856). - CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857). - CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371) Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-623=1 Package List: - openSUSE Leap 16.0: tomcat-9.0.117-160000.1.1 tomcat-admin-webapps-9.0.117-160000.1.1 tomcat-docs-webapp-9.0.117-160000.1.1 tomcat-el-3_0-api-9.0.117-160000.1.1 tomcat-embed-9.0.117-160000.1.1 tomcat-javadoc-9.0.117-160000.1.1 tomcat-jsp-2_3-api-9.0.117-160000.1.1 tomcat-jsvc-9.0.117-160000.1.1 tomcat-lib-9.0.117-160000.1.1 tomcat-servlet-4_0-api-9.0.117-160000.1.1 tomcat-webapps-9.0.117-160000.1.1 References: * https://www.suse.com/security/cve/CVE-2025-66614.html * https://www.suse.com/security/cve/CVE-2026-24880.html * https://www.suse.com/security/cve/CVE-2026-25854.html * https://www.suse.com/security/cve/CVE-2026-29129.html * https://www.suse.com/security/cve/CVE-2026-29145.html * https://www.suse.com/security/cve/CVE-2026-29146.html * https://www.suse.com/security/cve/CVE-2026-32990.html * https://www.suse.com/security/cve/CVE-2026-34483.html * https://www.suse.com/security/cve/CVE-2026-34486.html * https://www.suse.com/security/cve/CVE-2026-34487.html * https://www.suse.com/security/cve/CVE-2026-34500.html . openSUSE provides security updates for Tomcat fixing multiple vulnerabilities and providing essential bug fixes. Stay secure!. openSUSE security update,tomcat vulnerabilities,tomcat patch instructions. . Severity: Important. LinuxSecurity.com Team
Apr 23, 2026
•Important
OpenSUSE
202
security advisoryimportanttomcatopenSUSE Leap 15.6 Tomcat 13 Request Handling Vulnerability Notice
An update that solves 11 vulnerabilities can now be installed.. # Security update for tomcat11 Announcement ID: SUSE-SU-2026:1558-1 Release Date: 2026-04-22T16:24:40Z Rating: important References: * bsc#1258371 * bsc#1261850 * bsc#1261851 * bsc#1261852 * bsc#1261853 * bsc#1261854 * bsc#1261855 * bsc#1261856 * bsc#1261857 Cross-References: * CVE-2025-66614 * CVE-2026-24880 * CVE-2026-25854 * CVE-2026-29129 * CVE-2026-29145 * CVE-2026-29146 * CVE-2026-32990 * CVE-2026-34483 * CVE-2026-34486 * CVE-2026-34487 * CVE-2026-34500 CVSS scores: * CVE-2025-66614 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2025-66614 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2025-66614 ( NVD ): 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L * CVE-2025-66614 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-24880 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-24880 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-24880 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-25854 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-25854 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-25854 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-29129 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-29129 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-29129 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-29145 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-29145 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-29145 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-29146 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-29146 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-29146 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-32990 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-34483 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-34483 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-34483 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34486 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-34486 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34486 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34487 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-34487 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34487 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34500 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-34500 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-34500 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N Affected Products: * openSUSE Leap 15.6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * Web and Scripting Module 15-SP7 An update that solves 11 vulnerabilities can now be installed. ## Description: This update for tomcat11 fixes the following issues: Security fixes: * CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850). * CVE-2026-25854: Occasionally open redirect (bsc#1261851). * CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852). *CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853). * CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854). * CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855). * CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856). * CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857). * CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371). Other fixes: * Update to Tomcat 11.0.21 ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2026-1558=1 * Web and Scripting Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-1558=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1558=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1558=1 ## Package List: * openSUSE Leap 15.6 (noarch) * tomcat11-jsp-4_0-api-11.0.21-150600.13.18.1 * tomcat11-webapps-11.0.21-150600.13.18.1 * tomcat11-embed-11.0.21-150600.13.18.1 * tomcat11-jsvc-11.0.21-150600.13.18.1 * tomcat11-lib-11.0.21-150600.13.18.1 * tomcat11-doc-11.0.21-150600.13.18.1 * tomcat11-11.0.21-150600.13.18.1 * tomcat11-docs-webapp-11.0.21-150600.13.18.1 * tomcat11-admin-webapps-11.0.21-150600.13.18.1 * tomcat11-el-6_0-api-11.0.21-150600.13.18.1 * tomcat11-servlet-6_1-api-11.0.21-150600.13.18.1 * Web and Scripting Module 15-SP7 (noarch) * tomcat11-jsp-4_0-api-11.0.21-150600.13.18.1 * tomcat11-webapps-11.0.21-150600.13.18.1 * tomcat11-lib-11.0.21-150600.13.18.1 *tomcat11-11.0.21-150600.13.18.1 * tomcat11-admin-webapps-11.0.21-150600.13.18.1 * tomcat11-el-6_0-api-11.0.21-150600.13.18.1 * tomcat11-servlet-6_1-api-11.0.21-150600.13.18.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch) * tomcat11-jsp-4_0-api-11.0.21-150600.13.18.1 * tomcat11-webapps-11.0.21-150600.13.18.1 * tomcat11-lib-11.0.21-150600.13.18.1 * tomcat11-11.0.21-150600.13.18.1 * tomcat11-admin-webapps-11.0.21-150600.13.18.1 * tomcat11-el-6_0-api-11.0.21-150600.13.18.1 * tomcat11-servlet-6_1-api-11.0.21-150600.13.18.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch) * tomcat11-jsp-4_0-api-11.0.21-150600.13.18.1 * tomcat11-webapps-11.0.21-150600.13.18.1 * tomcat11-lib-11.0.21-150600.13.18.1 * tomcat11-11.0.21-150600.13.18.1 * tomcat11-admin-webapps-11.0.21-150600.13.18.1 * tomcat11-el-6_0-api-11.0.21-150600.13.18.1 * tomcat11-servlet-6_1-api-11.0.21-150600.13.18.1 ## References: * https://www.suse.com/security/cve/CVE-2025-66614.html * https://www.suse.com/security/cve/CVE-2026-24880.html * https://www.suse.com/security/cve/CVE-2026-25854.html * https://www.suse.com/security/cve/CVE-2026-29129.html * https://www.suse.com/security/cve/CVE-2026-29145.html * https://www.suse.com/security/cve/CVE-2026-29146.html * https://www.suse.com/security/cve/CVE-2026-32990.html * https://www.suse.com/security/cve/CVE-2026-34483.html * https://www.suse.com/security/cve/CVE-2026-34486.html * https://www.suse.com/security/cve/CVE-2026-34487.html * https://www.suse.com/security/cve/CVE-2026-34500.html * https://bugzilla.suse.com/show_bug.cgi?id=1258371 * https://bugzilla.suse.com/show_bug.cgi?id=1261850 * https://bugzilla.suse.com/show_bug.cgi?id=1261851 * https://bugzilla.suse.com/show_bug.cgi?id=1261852 * https://bugzilla.suse.com/show_bug.cgi?id=1261853 * https://bugzilla.suse.com/show_bug.cgi?id=1261854 * https://bugzilla.suse.com/show_bug.cgi?id=1261855 *https://bugzilla.suse.com/show_bug.cgi?id=1261856 * https://bugzilla.suse.com/show_bug.cgi?id=1261857 . Significant security update available for Tomcat 11 in openSUSE, addressing 11 important issues and vulnerabilities.. openSUSE Tomcat update security important issue. . Severity: Important. LinuxSecurity.com Team
Apr 23, 2026
•Important
OpenSUSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!