DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Apache Tomcat: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-09-22
Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen und um Daten zu manipulieren.
01
beschreibt (12)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-87022US | — | — | ||
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used.
This issue affects Apache… | ||||
| CVE-2026-86350US | — | Exploit | ||
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger reque… | ||||
| CVE-2026-86248US | — | — | ||
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-… | ||||
| CVE-2026-79677US | — | — | ||
Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asy… | ||||
| CVE-2026-78437US | — | — | ||
Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.
This issue affects A… | ||||
| CVE-2026-78383US | — | — | ||
Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of servi… | ||||
| CVE-2026-77791US | — | — | ||
Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.
This issue affects Apache Tomcat: from 11.0.0-M5… | ||||
| CVE-2026-77762US | — | — | ||
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another… | ||||
| CVE-2026-77756US | — | — | ||
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 re… | ||||
| CVE-2026-76183US | — | Exploit | ||
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed.
This issue affects Apache Tomc… | ||||
| CVE-2026-75973US | — | — | ||
Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web applicatio… | ||||
| CVE-2026-73581US | — | — | ||
Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore.
This… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Amazon Linux Security Advisory ALAS2-2026-4019 vom 2026-10-25external
- Amazon Linux Security Advisory ALAS2TOMCAT9-2026-029 vom 2026-10-13external
- Camunda Security Notice 171 vom 2026-10-09external
- openSUSE Security Update OPENSUSE-SU-2026:21984-1 vom 2026-10-01external
- SUSE Security Update SUSE-SU-2026:23985-1 vom 2026-10-05external
- SUSE Security Update SUSE-SU-2026:4546-1 vom 2026-10-06external
- SUSE Security Update SUSE-SU-2026:4544-1 vom 2026-10-06external
- F5 Security Advisory K000163606 vom 2026-10-08external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan