Critical Security Update for Apache Tomcat: Multiple Vulnerabilities Addressed
Summary
ALSA-2026:68677: Important: tomcat security update. Affects tomcat versions < 1:9.0.120-1.el8_10. Fixed in 1:9.0.120-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely-used open-source servlet container that implements the Java Servlet and JavaServer Pages (JSP) technologies. It serves as a platform for running Java applications, providing essential features such as request handling, session management, and security configurations. However, recent vulnerabilities have been identified that could compromise the security of applications running on Tomcat, necessitating immediate attention and remediation.
Vulnerability Detail
The vulnerabilities in Apache Tomcat include authentication bypass via digest authentication, improper handling of HTTP/2 request headers, information disclosure during WebSocket authentication, and various authorization issues. These vulnerabilities can lead to unauthorized access, data exposure, and potential security breaches, impacting the integrity and confidentiality of applications deployed on the Tomcat server.
How To Fix
Minimum fixed version
1:9.0.120-1.el8_10
This is the first release that contains the fix.
sudo dnf update tomcatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling features that are known to be vulnerable, such as HTTP/2 support, until the packages can be updated. This can be done by modifying the server configuration files to disable HTTP/2.
Conclusion
The recent vulnerabilities identified in Apache Tomcat pose significant risks to applications running on this platform. It is crucial to update to the latest patched version to ensure security and protect against potential exploits. Regular monitoring and prompt action are essential to maintain the integrity of your applications.
See every vulnerability recorded for tomcat →
FAQ
The update addresses multiple vulnerabilities including authentication bypass, improper authorization, and information disclosure during WebSocket authentication.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without requiring any installation.
If immediate updates are not possible, consider disabling vulnerable features as a temporary workaround to mitigate risks.
It is recommended to regularly check for vulnerabilities, ideally on a weekly basis, to ensure your software remains secure.
For more details, refer to the CVE pages listed in the advisory or visit the official Apache Tomcat documentation.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
