Moderate Security Update for Tomcat9: Multiple Vulnerabilities Addressed
Summary
RLSA-2026:68651: Moderate: tomcat9 security update. Affects tomcat9 versions < 1:9.0.120-1.el10_2. Fixed in 1:9.0.120-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely-used servlet container that implements the Java Servlet and JavaServer Pages specifications. Developed under the Apache Software License version 2.0, Tomcat serves as a reliable platform for running Java applications. Its open-source nature allows for collaborative development, making it a popular choice among developers worldwide. However, recent vulnerabilities have been identified that could compromise the security of applications running on Tomcat9.
Vulnerability Detail
The vulnerabilities in Tomcat9 include improper input validation, authentication bypass via digest authentication, and insufficient validation of HTTP/2 request headers. Additionally, there are issues related to information disclosure during WebSocket authentication, improper authorization, and case sensitivity handling in LockOutRealm. These vulnerabilities can lead to security bypasses, unauthorized access, and potential data exposure, posing significant risks to applications relying on Tomcat9.
How To Fix
Minimum fixed version
1:9.0.120-1.el10_2
This is the first release that contains the fix.
sudo dnf update tomcat9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as restricting access to sensitive endpoints and enhancing authentication mechanisms until the package can be updated.
Conclusion
In summary, the recent vulnerabilities identified in Tomcat9 pose significant risks to applications utilizing this servlet container. It is crucial to update to the latest patched version to safeguard against potential security breaches. Utilizing tools like Vulert can help monitor and alert for vulnerabilities in real-time, ensuring your software remains secure.
See every vulnerability recorded for tomcat9 →
FAQ
The vulnerabilities have a CVSS score of 7.3, indicating a moderate severity level.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
The vulnerabilities may lead to unauthorized access, data exposure, and security bypasses, which can compromise the integrity of applications running on Tomcat9.
Yes, it is highly recommended to update Tomcat9 to the patched version to mitigate the risks associated with these vulnerabilities.
Implement additional security measures as a temporary workaround, such as restricting access to sensitive areas of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for tomcat9.
