DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Apache Tomcat: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-08-25
Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Berechtigungen zu erweitern, Daten zu manipulieren oder offenzulegen oder Denial-of-Service-Zustände zu verursachen.
01
beschreibt (10)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-73180US | — | — | ||
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been esta… | ||||
| CVE-2026-68763US | — | — | ||
Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset
This issue affects Apache Tomcat: f… | ||||
| CVE-2026-68569US | — | — | ||
Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist… | ||||
| CVE-2026-68525US | —OT erhöht | — | ||
Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST bu… | ||||
| CVE-2026-66422US | — | — | ||
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct us… | ||||
| CVE-2026-65927US | — | — | ||
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.… | ||||
| CVE-2026-65905US | —OT erhöht | — | ||
Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST
authenticated… | ||||
| CVE-2026-65637US | — | — | ||
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.
This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 t… | ||||
| CVE-2026-65183US | — | — | ||
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socke… | ||||
| CVE-2026-65182US | —OT erhöht | — | ||
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more res… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2026:63137 vom 2026-09-03external
- Red Hat Security Advisory RHSA-2026:73981 vom 2026-10-02external
- Red Hat Security Advisory RHSA-2026:73982 vom 2026-10-01external
- Red Hat Security Advisory RHSA-2026:76952 vom 2026-10-07external
- Red Hat Security Advisory RHSA-2026:76956 vom 2026-10-07external
- openSUSE Security Update OPENSUSE-SU-2026:11761-1 vom 2026-09-14external
- openSUSE Security Update OPENSUSE-SU-2026:11759-1 vom 2026-09-14external
- SUSE Security Update SUSE-SU-2026:4114-1 vom 2026-09-14external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan