Every CVE Search/ Get API key

CVE-2026-34500

Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

6.5 MediumFix available

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.46%Up 0.4 points since Apr 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Record
CVE-2026-34500
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2026-21059 6.5

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Record
EUVD-2026-21059
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-24j9-x2wg-9qv6 6.5

Apache Tomcat: CLIENT_CERT authentication does not fail as expected

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Record
GHSA-24j9-x2wg-9qv6
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-287
Updated
2026-11-02
NVD 6.5

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Record
CVE-2026-34500
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-287
Updated
2026-11-02
OSV 6.5

Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Record
CVE-2026-34500
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2026-34500 6.5

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Record
DEBIAN-CVE-2026-34500
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
Show 25 moreShow less
OSVGHSA-24j9-x2wg-9qv6 6.5

Apache Tomcat: CLIENT_CERT authentication does not fail as expected

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Record
GHSA-24j9-x2wg-9qv6
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-287
Updated
2026-11-02
OSVOESA-2026-1970 9.1

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.(CVE-2026-24880)

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-25854)

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-29129)

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.(CVE-2026-29145)

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.(CVE-2026-29146)

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-32990)

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.(CVE-2026-34483)

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.(CVE-2026-34486)

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.(CVE-2026-34487)

CLIENT_CERT authentication does not fail as expected for some…

Record
OESA-2026-1970
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:20405 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.3 release and security update

Record
RHSA-2026:20405
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:26323 7.4

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:26323
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:25341 7.4

Important: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)

  • tomcat: Client certificate verification bypass due to virtual host mapping (CVE-2025-66614)

  • tomcat: security constraint bypass with HTTP/0.9 (CVE-2026-24733)

  • Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration (CVE-2026-29145)

  • Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files (CVE-2026-34487)

  • Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve (CVE-2026-25854)

  • Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension (CVE-2026-24880)

  • Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration (CVE-2026-34500)

  • Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve (CVE-2026-34483)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25341
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-34500 6.5

CVE-2026-34500 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-34500 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2026-34500
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-34500 6.5

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Record
UBUNTU-CVE-2026-34500
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVALSA-2026:25341 No score

Important: tomcat9 update

Certificate revocation bypass due to improper OCSP response validation

Record
ALSA-2026:25341
Updated
2026-11-02
OSVALSA-2026:26323 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:26323
Updated
2026-11-02
OSVALSA-2026:36790 No score

Important: tomcat9 security, bug fix, and enhancement update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)
  • Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

  • Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-185571)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:36790
Updated
2026-11-02
OSVBIT-tomcat-2026-34500 No score

Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Record
BIT-tomcat-2026-34500
Updated
2026-11-02
OSVMGASA-2026-0095 No score

Updated tomcat packages fix security vulnerabilities

Request smuggling via invalid chunk extension. (CVE-2026-24880) Occasionally open redirect. (CVE-2026-25854) TLS cipher order is not preserved. (CVE-2026-29129) OCSP checks sometimes soft-fail even when soft-fail is disabled. (CVE-2026-29145) EncryptInterceptor vulnerable to padding oracle attack by default. (CVE-2026-29146) Fix for CVE-2025-66614 is incomplete. (CVE-2026-32990) Incomplete escaping of JSON access logs. (CVE-2026-34483) Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor. (CVE-2026-34486) Cloud membership for clustering component exposed the Kubernetes bearer token. (CVE-2026-34487) OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled. (CVE-2026-34500)

Record
MGASA-2026-0095
Updated
2026-11-02
OSVopenSUSE-SU-2026:10547-1 No score

tomcat-9.0.117-1.1 on GA media

These are all security issues fixed in the tomcat-9.0.117-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10547-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10548-1 No score

tomcat10-10.1.54-1.1 on GA media

These are all security issues fixed in the tomcat10-10.1.54-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10548-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10549-1 No score

tomcat11-11.0.21-1.1 on GA media

These are all security issues fixed in the tomcat11-11.0.21-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10549-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20595-1 No score

Security update for tomcat11

This update for tomcat11 fixes the following issues:

  • Update to Tomcat 11.0.21
  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)
Record
openSUSE-SU-2026:20595-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20611-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)
Record
openSUSE-SU-2026:20611-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20612-1 No score

Security update for tomcat10

This update for tomcat10 fixes the following issues:

  • Update to Tomcat 10.1.54
  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)
Record
openSUSE-SU-2026:20612-1
Updated
2026-11-02
OSVSUSE-SU-2026:1558-1 No score

Security update for tomcat11

This update for tomcat11 fixes the following issues:

Security fixes:

  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

  • Update to Tomcat 11.0.21
Record
SUSE-SU-2026:1558-1
Updated
2026-11-02
OSVSUSE-SU-2026:1572-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

Security fixes:

  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

  • Update to Tomcat 9.0.117
Record
SUSE-SU-2026:1572-1
Updated
2026-11-02
OSVSUSE-SU-2026:1603-1 No score

Security update for tomcat10

This update for tomcat10 fixes the following issues:

Security fixes:

  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

  • Update to Tomcat 10.1.54
Record
SUSE-SU-2026:1603-1
Updated
2026-11-02
OSVSUSE-SU-2026:1604-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

Security fixes:

  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

  • Update to Tomcat 9.0.117
Record
SUSE-SU-2026:1604-1
Updated
2026-11-02
OSVSUSE-SU-2026:21366-1 No score

Security update for tomcat11

This update for tomcat11 fixes the following issues:

  • Update to Tomcat 11.0.21
  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)
Record
SUSE-SU-2026:21366-1
Updated
2026-11-02
OSVSUSE-SU-2026:21378-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)
Record
SUSE-SU-2026:21378-1
Updated
2026-11-02
OSVSUSE-SU-2026:21379-1 No score

Security update for tomcat10

This update for tomcat10 fixes the following issues:

  • Update to Tomcat 10.1.54
  • CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
  • CVE-2026-25854: Occasionally open redirect (bsc#1261851).
  • CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
  • CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
  • CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
  • CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
  • CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
  • CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
  • CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)
Record
SUSE-SU-2026:21379-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat-coyote-ffm
Maven
 9.0.92 up to 9.0.117
9.0.117
org.apache.tomcat:tomcat-coyote-ffm
Maven
 10.1.22 up to 10.1.54
10.1.54
org.apache.tomcat:tomcat-coyote-ffm
Maven
 11.0.0-M14 up to 11.0.21
11.0.21
tomcat9
AlmaLinux:10
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat9-admin-webapps
AlmaLinux:10
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat9-docs-webapp
AlmaLinux:10
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat9-el-3.0-api
AlmaLinux:10
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat9-jsp-2.3-api
AlmaLinux:10
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat9-lib
AlmaLinux:10
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat9-servlet-4.0-api
AlmaLinux:10
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
Show 112 moreShow less
Affected packages
PackageAffectedFixed
tomcat9-webapps
AlmaLinux:10
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat
AlmaLinux:9
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-admin-webapps
AlmaLinux:9
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-docs-webapp
AlmaLinux:9
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-el-3.0-api
AlmaLinux:9
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-jsp-2.3-api
AlmaLinux:9
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-lib
AlmaLinux:9
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-servlet-4.0-api
AlmaLinux:9
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-webapps
AlmaLinux:9
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat9
AlmaLinux:10
From an advisory covering 13 CVEs
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-admin-webapps
AlmaLinux:10
From an advisory covering 13 CVEs
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-docs-webapp
AlmaLinux:10
From an advisory covering 13 CVEs
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-el-3.0-api
AlmaLinux:10
From an advisory covering 13 CVEs
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-jsp-2.3-api
AlmaLinux:10
From an advisory covering 13 CVEs
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-lib
AlmaLinux:10
From an advisory covering 13 CVEs
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-servlet-4.0-api
AlmaLinux:10
From an advisory covering 13 CVEs
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-webapps
AlmaLinux:10
From an advisory covering 13 CVEs
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat
Bitnami
 9.0.92 up to 9.0.117, 10.1.22 up to 10.1.54, 11.0.0 up to 11.0.21
9.0.11710.1.5411.0.21
tomcat10
Debian:12
 before 10.1.55-1~deb12u1, plus listed versions
10.1.10-110.1.13-110.1.14-110.1.15-110.1.16-1
Show 28 moreShow less
10.1.20-110.1.23-110.1.25-110.1.25-1~bpo12+110.1.25-210.1.30-110.1.30-1~bpo12+110.1.31-110.1.33-110.1.33-1~bpo12+110.1.34-0+deb12u110.1.34-0+deb12u210.1.34-110.1.35-110.1.40-110.1.40-1~bpo12+110.1.46-110.1.52-110.1.52-1~deb12u110.1.52-1~deb13u110.1.52-210.1.54-110.1.6-110.1.6-1+deb12u110.1.6-1+deb12u210.1.7-110.1.8-110.1.9-1
10.1.55-1~deb12u1
tomcat10
Debian:13
 before 10.1.55-1~deb13u1, plus listed versions
10.1.40-110.1.46-110.1.52-110.1.52-1~deb12u110.1.52-1~deb13u110.1.52-210.1.54-110.1.55-1~deb12u1
10.1.55-1~deb13u1
tomcat10
Debian:14
 before 10.1.54-1, plus listed versions
10.1.40-110.1.46-110.1.52-110.1.52-1~deb12u110.1.52-1~deb13u110.1.52-2
10.1.54-1
tomcat11
Debian:13
 before 11.0.22-1~deb13u1, plus listed versions
11.0.11-111.0.15-111.0.15-1~deb13u111.0.18-111.0.21-111.0.6-1
11.0.22-1~deb13u1
tomcat11
Debian:14
 before 11.0.21-1, plus listed versions
11.0.11-111.0.15-111.0.15-1~deb13u111.0.18-111.0.6-1
11.0.21-1
tomcat9
Debian:12
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:13
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:14
 before 9.0.70-2
9.0.70-2
org.apache.tomcat:tomcat-coyote-ffm
Maven
 9.0.92 up to 9.0.117, plus listed versions
9.0.1009.0.1029.0.1049.0.1059.0.106
Show 16 moreShow less
9.0.1079.0.1089.0.1099.0.1109.0.1119.0.1129.0.1139.0.1159.0.1169.0.939.0.949.0.959.0.969.0.979.0.989.0.99
9.0.117
org.apache.tomcat:tomcat-coyote-ffm
Maven
 10.1.22 up to 10.1.54, plus listed versions
10.1.2610.1.2810.1.2910.1.3010.1.31
Show 18 moreShow less
10.1.3310.1.3410.1.3510.1.3610.1.3910.1.4010.1.4110.1.4210.1.4310.1.4410.1.4510.1.4610.1.4710.1.4810.1.4910.1.5010.1.5210.1.53
10.1.54
org.apache.tomcat:tomcat-coyote-ffm
Maven
 11.0.0-M14 up to 11.0.21, plus listed versions
11.0.011.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M26
Show 17 moreShow less
11.0.111.0.1011.0.1111.0.1211.0.1311.0.1411.0.1511.0.1811.0.211.0.2011.0.311.0.411.0.511.0.611.0.711.0.811.0.9
11.0.21
tomcat
Mageia:9
From an advisory covering 10 CVEs
 before 9.0.117-1.mga9
9.0.117-1.mga9
tomcat
openEuler:24.03-LTS-SP3
From an advisory covering 10 CVEs
 before 9.0.117-1.oe2403sp3
9.0.117-1.oe2403sp3
tomcat
openEuler:20.03-LTS-SP4
From an advisory covering 10 CVEs
 before 9.0.117-1.oe2003sp4
9.0.117-1.oe2003sp4
tomcat
openEuler:22.03-LTS-SP4
From an advisory covering 10 CVEs
 before 9.0.117-1.oe2203sp4
9.0.117-1.oe2203sp4
tomcat
openEuler:24.03-LTS
From an advisory covering 10 CVEs
 before 9.0.117-1.oe2403sp2
9.0.117-1.oe2403sp2
tomcat
openEuler:24.03-LTS-SP1
From an advisory covering 10 CVEs
 before 9.0.117-1.oe2403sp1
9.0.117-1.oe2403sp1
tomcat
openEuler:24.03-LTS-SP2
From an advisory covering 10 CVEs
 before 9.0.117-1.oe2403sp2
9.0.117-1.oe2403sp2
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.2::el10
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el10jws
0:10.1.49-13.redhat_00011.1.el10jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.2::el10
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el10jws
0:10.1.49-13.redhat_00011.1.el10jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.2::el10
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el10jws
0:10.1.49-13.redhat_00011.1.el10jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.2::el10
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el10jws
0:10.1.49-13.redhat_00011.1.el10jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.2::el10
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el10jws
0:10.1.49-13.redhat_00011.1.el10jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.2::el10
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el10jws
0:10.1.49-13.redhat_00011.1.el10jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.2::el10
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el10jws
0:10.1.49-13.redhat_00011.1.el10jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.2::el10
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el10jws
0:10.1.49-13.redhat_00011.1.el10jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.2::el10
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el10jws
0:10.1.49-13.redhat_00011.1.el10jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.2::el10
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el10jws
0:10.1.49-13.redhat_00011.1.el10jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.2::el8
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el8jws
0:10.1.49-13.redhat_00011.1.el8jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.2::el8
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el8jws
0:10.1.49-13.redhat_00011.1.el8jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.2::el8
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el8jws
0:10.1.49-13.redhat_00011.1.el8jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.2::el8
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el8jws
0:10.1.49-13.redhat_00011.1.el8jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.2::el8
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el8jws
0:10.1.49-13.redhat_00011.1.el8jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.2::el8
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el8jws
0:10.1.49-13.redhat_00011.1.el8jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.2::el8
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el8jws
0:10.1.49-13.redhat_00011.1.el8jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.2::el8
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el8jws
0:10.1.49-13.redhat_00011.1.el8jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.2::el8
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el8jws
0:10.1.49-13.redhat_00011.1.el8jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.2::el8
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el8jws
0:10.1.49-13.redhat_00011.1.el8jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.2::el9
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el9jws
0:10.1.49-13.redhat_00011.1.el9jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.2::el9
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el9jws
0:10.1.49-13.redhat_00011.1.el9jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.2::el9
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el9jws
0:10.1.49-13.redhat_00011.1.el9jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.2::el9
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el9jws
0:10.1.49-13.redhat_00011.1.el9jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.2::el9
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el9jws
0:10.1.49-13.redhat_00011.1.el9jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.2::el9
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el9jws
0:10.1.49-13.redhat_00011.1.el9jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.2::el9
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el9jws
0:10.1.49-13.redhat_00011.1.el9jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.2::el9
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el9jws
0:10.1.49-13.redhat_00011.1.el9jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.2::el9
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el9jws
0:10.1.49-13.redhat_00011.1.el9jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.2::el9
From an advisory covering 7 CVEs
 before 0:10.1.49-13.redhat_00011.1.el9jws
0:10.1.49-13.redhat_00011.1.el9jws
tomcat
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-admin-webapps
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-docs-webapp
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-el-3.0-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-jsp-2.3-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-lib
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-servlet-4.0-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-webapps
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat9
Rocky Linux:10
From an advisory covering 9 CVEs
 before 1:9.0.117-1.el10_2
1:9.0.117-1.el10_2
org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 11.0.20-aikido.15
11.0.20-aikido.1510.1.39-aikido.1611.0.20-aikido.1210.1.39-aikido.1710.1.34-aikido.510.1.39-aikido.1810.1.53-aikido.1011.0.20-aikido.1610.1.34-aikido.611.0.20-aikido.1410.1.39-aikido.1910.1.39-aikido.2010.1.34-aikido.7
io.root.org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 11.0.20-root.io.6
11.0.20-root.io.610.1.39-root.io.710.1.39-root.io.810.1.39-root.io.910.1.39-root.io.1010.1.39-root.io.1110.1.39-root.io.1211.0.20-root.io.711.0.20-root.io.810.1.34-root.io.111.0.20-root.io.910.1.34-root.io.210.1.39-root.io.1310.1.39-root.io.1411.0.20-root.io.1010.1.39-root.io.1511.0.20-root.io.1110.1.34-root.io.311.0.20-root.io.1510.1.53-root.io.710.1.53-root.io.810.1.39-root.io.1810.1.39-root.io.1611.0.20-root.io.1210.1.39-root.io.1710.1.53-root.io.1010.1.34-root.io.511.0.20-root.io.1610.1.34-root.io.611.0.20-root.io.1410.1.39-root.io.1910.1.39-root.io.2010.1.34-root.io.7
tomcat11
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 11 CVEs
 before 11.0.21-150600.13.18.1
11.0.21-150600.13.18.1
tomcat11
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 11 CVEs
 before 11.0.21-150600.13.18.1
11.0.21-150600.13.18.1
tomcat11
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 11 CVEs
 before 11.0.21-150600.13.18.1
11.0.21-150600.13.18.1
tomcat
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 11 CVEs
 before 9.0.117-3.163.2
9.0.117-3.163.2
tomcat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 11 CVEs
 before 9.0.117-3.163.2
9.0.117-3.163.2
tomcat10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 11 CVEs
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 11 CVEs
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 11 CVEs
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 11 CVEs
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 11 CVEs
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 11 CVEs
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 11 CVEs
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
From an advisory covering 11 CVEs
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 11 CVEs
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 11 CVEs
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 11 CVEs
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 11 CVEs
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 11 CVEs
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 11 CVEs
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 11 CVEs
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 11 CVEs
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 11 CVEs
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 11 CVEs
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat10
Ubuntu:25.10
 All versions, plus listed versions
10.1.35-110.1.40-110.1.40-1ubuntu110.1.40-1ubuntu1.25.10.1
 None known
tomcat11
Ubuntu:25.10
 All versions, plus listed versions
11.0.6-1
 None known
tomcat9
Ubuntu:25.10
 All versions, plus listed versions
9.0.70-2ubuntu1.19.0.70-2ubuntu29.0.70-2ubuntu39.0.95-1ubuntu19.0.95-1ubuntu1.1
 None known
tomcat10
Ubuntu:26.04:LTS
 All versions, plus listed versions
10.1.40-1ubuntu110.1.40-1ubuntu1.26.04.110.1.55-1ubuntu2~26.04.1
 None known
tomcat9
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.0.95-1ubuntu19.0.111-19.0.115-19.0.115-1ubuntu0.19.0.118-1~26.04.1
 None known
tomcat11
Ubuntu:26.04:LTS
 All versions, plus listed versions
11.0.6-111.0.11-111.0.15-111.0.18-111.0.18-1ubuntu0.1~esm111.0.22-2ubuntu2~26.04.1
 None known
tomcat
openSUSE:Tumbleweed
From an advisory covering 10 CVEs
 before 9.0.117-1.1
9.0.117-1.1
tomcat10
openSUSE:Tumbleweed
From an advisory covering 10 CVEs
 before 10.1.54-1.1
10.1.54-1.1
tomcat11
openSUSE:Tumbleweed
From an advisory covering 10 CVEs
 before 11.0.21-1.1
11.0.21-1.1
tomcat11
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 11.0.21-160000.1.1
11.0.21-160000.1.1
tomcat
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 9.0.117-160000.1.1
9.0.117-160000.1.1
tomcat10
openSUSE:Leap 16.0
From an advisory covering 11 CVEs
 before 10.1.54-160000.1.1
10.1.54-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34500 is a medium vulnerability (CVSS 6.5) in Apache Tomcat, published April 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in org.apache.tomcat:tomcat-coyote-ffm 9.0.117.

References

Show 133 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open