DeutschShown in its original language — a full translation is planned for a future version.
Apache Tomcat: Mehrere Schwachstellen
view advisory published 2026-08-25
Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Berechtigungen zu erweitern, Daten zu manipulieren oder offenzulegen oder Denial-of-Service-Zustände zu verursachen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-73180US | — | — | ||
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been esta… | ||||
| CVE-2026-68763US | — | — | ||
Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset
This issue affects Apache Tomcat: f… | ||||
| CVE-2026-68569US | — | — | ||
Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist… | ||||
| CVE-2026-68525US | —OT elevated | — | ||
Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST bu… | ||||
| CVE-2026-66422US | — | — | ||
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct us… | ||||
| CVE-2026-65927US | — | — | ||
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.… | ||||
| CVE-2026-65905US | —OT elevated | — | ||
Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST
authenticated… | ||||
| CVE-2026-65637US | — | — | ||
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 t… | ||||
| CVE-2026-65183US | — | — | ||
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socke… | ||||
| CVE-2026-65182US | —OT elevated | — | ||
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more res… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:63137 vom 2026-09-03external
- Red Hat Security Advisory RHSA-2026:73981 vom 2026-10-02external
- Red Hat Security Advisory RHSA-2026:73982 vom 2026-10-01external
- Red Hat Security Advisory RHSA-2026:76952 vom 2026-10-07external
- Red Hat Security Advisory RHSA-2026:76956 vom 2026-10-07external
- openSUSE Security Update OPENSUSE-SU-2026:11761-1 vom 2026-09-14external
- openSUSE Security Update OPENSUSE-SU-2026:11759-1 vom 2026-09-14external
- SUSE Security Update SUSE-SU-2026:4114-1 vom 2026-09-14external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan