Moderate Security Update for Tomcat9: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:68651: Moderate: tomcat9 security update. Affects tomcat9 versions < 1:9.0.120-1.el10_2.alma.1. Fixed in 1:9.0.120-1.el10_2.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tomcat9 is a widely used servlet container that serves as the reference implementation for Java Servlet and JavaServer Pages technologies. Developed under the Apache Software License version 2.0, Tomcat9 facilitates the deployment of Java applications and is known for its collaborative development environment. However, it has recently been identified to have several security vulnerabilities that could impact its functionality and security.
Vulnerability Detail
The vulnerabilities in Tomcat9 stem from improper input validation, authentication bypass, and information disclosure, among others. Specifically, issues such as incomplete fixes for input validation (CVE-2026-32990), authentication bypass via digest authentication (CVE-2026-43512), and exposure of HTTP Authentication Headers during WebSocket authentication (CVE-2026-42498) could lead to unauthorized access and data leakage. These vulnerabilities highlight the importance of maintaining secure configurations and timely updates.
How To Fix
Minimum fixed version
1:9.0.120-1.el10_2.alma.1
This is the first release that contains the fix.
sudo dnf update tomcat9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to sensitive endpoints and ensure that proper authentication mechanisms are in place. Additionally, consider disabling HTTP/2 if it is not required for your application until the update is applied.
Conclusion
The recent vulnerabilities identified in Tomcat9 pose significant risks to applications relying on this servlet container. It is crucial to apply the necessary updates and maintain secure configurations to mitigate these risks effectively.
See every vulnerability recorded for tomcat9 →
FAQ
The main vulnerabilities include improper input validation, authentication bypass, and information disclosure, among others.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
These vulnerabilities can lead to unauthorized access, data leakage, and potential security breaches in applications using Tomcat9.
Yes, a patch is available in version 1:9.0.120-1.el10_2.alma.1. It is recommended to update to this version.
If immediate updates are not possible, implement strict access controls and review your application's security configurations as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat9.
