DeutschShown in its original language — a full translation is planned for a future version.
Apache Tomcat: Mehrere Schwachstellen
view advisory published 2026-10-20
Ein entfernter Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder einen Denial of Service Angriff durchzuführen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-93446US | — | — | ||
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.
This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from… | ||||
| CVE-2026-88041US | — | — | ||
Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request.
This issue affects Apache Tomcat: fro… | ||||
| CVE-2026-80353US | — | — | ||
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to… | ||||
| CVE-2026-74049US | — | — | ||
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 th… | ||||
| CVE-2026-74048US | — | — | ||
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and erro… | ||||
| CVE-2026-103119US | — | — | ||
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next reques… | ||||
| CVE-2026-101356US | — | — | ||
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.… | ||||
| CVE-2026-101296US | — | — | ||
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers t… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Bugtracker 2556181 vom 2026-10-20external
- Red Hat Bugtracker 2556182 vom 2026-10-20external
- Red Hat Bugtracker 2556183 vom 2026-10-20external
- Red Hat Bugtracker 2556184 vom 2026-10-20external
- Red Hat Bugtracker 2556185 vom 2026-10-20external
- Red Hat Bugtracker 2556186 vom 2026-10-20external
- Red Hat Bugtracker 2556187 vom 2026-10-20external
- Red Hat Bugtracker 2556195 vom 2026-10-20external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan