Moderate Vulnerability in Apache Tomcat Packages: Improper Input Validation and Authentication Bypass
Summary
ALSA-2026:69259: Moderate: tomcat update. Affects tomcat versions < 1:10.1.49-4.el10_2.alma.1. Fixed in 1:10.1.49-4.el10_2.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely used servlet container that implements the Java Servlet and JavaServer Pages (JSP) technologies. It serves as a platform for running Java applications and is known for its scalability and robustness. However, recent vulnerabilities have been identified that could compromise the security of applications running on Tomcat, particularly affecting versions prior to 1:10.1.49-4.el10_2.alma.1.
Vulnerability Detail
The vulnerabilities in Apache Tomcat stem from improper input validation, authentication bypass via digest authentication, and exposure of HTTP Authentication Headers during WebSocket authentication. These issues can lead to unauthorized access, information disclosure, and security bypass, potentially allowing attackers to exploit the system and gain sensitive information.
How To Fix
Minimum fixed version
1:10.1.49-4.el10_2.alma.1
This is the first release that contains the fix.
sudo dnf update tomcatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the Tomcat server by implementing firewall rules or using a reverse proxy to limit exposure until the packages are updated.
Conclusion
The identified vulnerabilities in Apache Tomcat pose significant risks to applications running on this platform. It is crucial to update to the latest patched version to mitigate these risks and ensure the security of your applications.
See every vulnerability recorded for tomcat →
FAQ
The vulnerabilities include improper input validation, authentication bypass, and information disclosure, which can lead to unauthorized access and security breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Update your Apache Tomcat packages to the patched version 1:10.1.49-4.el10_2.alma.1 and implement firewall rules to restrict access.
Yes, you can use a reverse proxy or firewall rules to limit access to the Tomcat server until the vulnerabilities are patched.
You can refer to the CVE pages linked in the advisory for detailed information about each vulnerability and its impact.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
