CVE-2026-29145

Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

9.1 CriticalPublic exploitFix available

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.73%Up 0.7 points since Apr 10, 2026

What each source reports

CVE List Score used 9.1

Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Record: CVE-2026-29145
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

EUVDEUVD-2026-21011 9.1

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Record: EUVD-2026-21011
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-95jq-rwvf-vjx4 9.1

Apache Tomcat: CLIENT_CERT authentication does not fail as expected

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Record: GHSA-95jq-rwvf-vjx4
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

NVD 9.1

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Record: CVE-2026-29145
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSV 9.1

Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Record: CVE-2026-29145
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-29145 9.1

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Record: DEBIAN-CVE-2026-29145
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

Show 36 moreShow less

OSVGHSA-95jq-rwvf-vjx4 9.1

Apache Tomcat: CLIENT_CERT authentication does not fail as expected

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Record: GHSA-95jq-rwvf-vjx4
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSVOESA-2026-1970 9.1

tomcat security update

Security Fix(es):

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.(CVE-2026-24880)

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-25854)

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-29129)

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.(CVE-2026-29145)

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.(CVE-2026-29146)

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-32990)

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.(CVE-2026-34483)

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.(CVE-2026-34486)

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.(CVE-2026-34487)

CLIENT_CERT authentication does not fail as expected for some…

Record: OESA-2026-1970
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:20405 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.3 release and security update

Record: RHSA-2026:20405
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:26323 7.4

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:26323
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:67163 7.5

Red Hat Security Advisory: tomcat9 security update

Record: RHSA-2026:67163
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68659 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68659
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68677 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68677
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68678 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68678
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68679 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68679
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68680 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68680
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:25341 7.4

Important: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)
tomcat: Client certificate verification bypass due to virtual host mapping (CVE-2025-66614)
tomcat: security constraint bypass with HTTP/0.9 (CVE-2026-24733)
Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration (CVE-2026-29145)
Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files (CVE-2026-34487)
Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve (CVE-2026-25854)
Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension (CVE-2026-24880)
Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration (CVE-2026-34500)
Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve (CVE-2026-34483)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:25341
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2026-29145 9.1

CVE-2026-29145 in io.root.org.apache.tomcat:tomcat-catalina - Patched by Root

Root has patched CVE-2026-29145 in the io.root.org.apache.tomcat:tomcat-catalina package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2026-29145
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-29145 9.1

Record: UBUNTU-CVE-2026-29145
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVALSA-2026:25341 No score

Important: tomcat9 update

Certificate revocation bypass due to improper OCSP response validation

Record: ALSA-2026:25341
Updated: 2026-11-02

OSVALSA-2026:26323 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:26323
Updated: 2026-11-02

OSVALSA-2026:36790 No score

Important: tomcat9 security, bug fix, and enhancement update

Security Fix(es):

Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)
Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-185571)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:36790
Updated: 2026-11-02

OSVALSA-2026:68677 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)
tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:68677
Updated: 2026-11-02

OSVBIT-tomcat-2026-29145 No score

Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.18, from 10.1.0 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Record: BIT-tomcat-2026-29145
Updated: 2026-11-02

OSVCLSA-2026-1776299665 No score

TuxCare security update for 3 packages (3 CVEs)

TuxCare rebuilt 3 packages to address 3 CVEs. Fixed in 10.1.18-tuxcare.3.

Record: CLSA-2026-1776299665
Updated: 2026-11-02

OSVCLSA-2026-1792666002 No score

TuxCare security update for 6 packages (17 CVEs)

TuxCare rebuilt 6 packages to address 17 CVEs. Fixed in 10.1.33-tuxcare.1.

Record: CLSA-2026-1792666002
Updated: 2026-11-02

OSVCLSA-2026-1792692686 No score

TuxCare security update for 5 packages (15 CVEs)

TuxCare rebuilt 5 packages to address 15 CVEs. Fixed in 10.1.16-tuxcare.1.

Record: CLSA-2026-1792692686
Updated: 2026-11-02

OSVCLSA-2026-1792765354 No score

TuxCare security update for 6 packages (6 CVEs)

TuxCare rebuilt 6 packages to address 6 CVEs. Fixed in 10.1.50-tuxcare.2.

Record: CLSA-2026-1792765354
Updated: 2026-11-02

OSVMGASA-2026-0095 No score

Updated tomcat packages fix security vulnerabilities

Request smuggling via invalid chunk extension. (CVE-2026-24880) Occasionally open redirect. (CVE-2026-25854) TLS cipher order is not preserved. (CVE-2026-29129) OCSP checks sometimes soft-fail even when soft-fail is disabled. (CVE-2026-29145) EncryptInterceptor vulnerable to padding oracle attack by default. (CVE-2026-29146) Fix for CVE-2025-66614 is incomplete. (CVE-2026-32990) Incomplete escaping of JSON access logs. (CVE-2026-34483) Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor. (CVE-2026-34486) Cloud membership for clustering component exposed the Kubernetes bearer token. (CVE-2026-34487) OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled. (CVE-2026-34500)

Record: MGASA-2026-0095
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10547-1 No score

tomcat-9.0.117-1.1 on GA media

These are all security issues fixed in the tomcat-9.0.117-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10547-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10548-1 No score

tomcat10-10.1.54-1.1 on GA media

These are all security issues fixed in the tomcat10-10.1.54-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10548-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10549-1 No score

tomcat11-11.0.21-1.1 on GA media

These are all security issues fixed in the tomcat11-11.0.21-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10549-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20595-1 No score

Security update for tomcat11

This update for tomcat11 fixes the following issues:

Update to Tomcat 11.0.21
CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Record: openSUSE-SU-2026:20595-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20611-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Record: openSUSE-SU-2026:20611-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20612-1 No score

Security update for tomcat10

This update for tomcat10 fixes the following issues:

Update to Tomcat 10.1.54
CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Record: openSUSE-SU-2026:20612-1
Updated: 2026-11-02

OSVSUSE-SU-2026:1558-1 No score

Security update for tomcat11

This update for tomcat11 fixes the following issues:

Security fixes:

CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

Update to Tomcat 11.0.21

Record: SUSE-SU-2026:1558-1
Updated: 2026-11-02

OSVSUSE-SU-2026:1572-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

Security fixes:

CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

Update to Tomcat 9.0.117

Record: SUSE-SU-2026:1572-1
Updated: 2026-11-02

OSVSUSE-SU-2026:1603-1 No score

Security update for tomcat10

This update for tomcat10 fixes the following issues:

Security fixes:

CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

Update to Tomcat 10.1.54

Record: SUSE-SU-2026:1603-1
Updated: 2026-11-02

OSVSUSE-SU-2026:1604-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

Security fixes:

CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

Update to Tomcat 9.0.117

Record: SUSE-SU-2026:1604-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21366-1 No score

Security update for tomcat11

This update for tomcat11 fixes the following issues:

Update to Tomcat 11.0.21
CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Record: SUSE-SU-2026:21366-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21378-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Record: SUSE-SU-2026:21378-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21379-1 No score

Security update for tomcat10

This update for tomcat10 fixes the following issues:

Update to Tomcat 10.1.54
CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Record: SUSE-SU-2026:21379-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.tomcat:tomcat` Maven	9.0.83 up to 9.0.116	9.0.116
`org.apache.tomcat:tomcat` Maven	10.1.0-M7 up to 10.1.53	10.1.53
`org.apache.tomcat:tomcat` Maven	11.0.0-M1 up to 11.0.20	11.0.20
`org.apache.tomcat:tomcat-coyote-ffm` Maven	9.0.83 up to 9.0.116	9.0.116
`org.apache.tomcat:tomcat-coyote-ffm` Maven	10.1.0-M7 up to 10.1.53	10.1.53
`org.apache.tomcat:tomcat-coyote-ffm` Maven	11.0.0-M1 up to 11.0.20	11.0.20
`tomcat9` AlmaLinux:10 From an advisory covering 9 CVEs	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat9-admin-webapps` AlmaLinux:10 From an advisory covering 9 CVEs	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat9-docs-webapp` AlmaLinux:10 From an advisory covering 9 CVEs	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat9-el-3.0-api` AlmaLinux:10 From an advisory covering 9 CVEs	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1

Show 205 moreShow less

Affected packages
Package	Affected	Fixed
`tomcat9-jsp-2.3-api` AlmaLinux:10 From an advisory covering 9 CVEs	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat9-lib` AlmaLinux:10 From an advisory covering 9 CVEs	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat9-servlet-4.0-api` AlmaLinux:10 From an advisory covering 9 CVEs	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat9-webapps` AlmaLinux:10 From an advisory covering 9 CVEs	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat` AlmaLinux:9 From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-admin-webapps` AlmaLinux:9 From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-docs-webapp` AlmaLinux:9 From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-el-3.0-api` AlmaLinux:9 From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-jsp-2.3-api` AlmaLinux:9 From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-lib` AlmaLinux:9 From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-servlet-4.0-api` AlmaLinux:9 From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-webapps` AlmaLinux:9 From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat9` AlmaLinux:10 From an advisory covering 13 CVEs	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-admin-webapps` AlmaLinux:10 From an advisory covering 13 CVEs	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-docs-webapp` AlmaLinux:10 From an advisory covering 13 CVEs	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-el-3.0-api` AlmaLinux:10 From an advisory covering 13 CVEs	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-jsp-2.3-api` AlmaLinux:10 From an advisory covering 13 CVEs	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-lib` AlmaLinux:10 From an advisory covering 13 CVEs	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-servlet-4.0-api` AlmaLinux:10 From an advisory covering 13 CVEs	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-webapps` AlmaLinux:10 From an advisory covering 13 CVEs	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat` AlmaLinux:8 From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-admin-webapps` AlmaLinux:8 From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-docs-webapp` AlmaLinux:8 From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-el-3.0-api` AlmaLinux:8 From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-jsp-2.3-api` AlmaLinux:8 From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-lib` AlmaLinux:8 From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-servlet-4.0-api` AlmaLinux:8 From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-webapps` AlmaLinux:8 From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat` Bitnami	before 8.5.98, 9.0.83 up to 9.0.116, 10.1.0 up to 10.1.53, 11.0.0 up to 11.0.20	8.5.989.0.11610.1.5311.0.20
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven From an advisory covering 3 CVEs	10.1.18 up to 10.1.18-tuxcare.3, plus listed versions 10.1.18-tuxcare.110.1.18-tuxcare.2	10.1.18-tuxcare.3
`org.apache.tomcat:tomcat` TuxCare:Maven From an advisory covering 3 CVEs	10.1.18 up to 10.1.18-tuxcare.3, plus listed versions 10.1.18-tuxcare.110.1.18-tuxcare.2	10.1.18-tuxcare.3
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven From an advisory covering 3 CVEs	10.1.18 up to 10.1.18-tuxcare.3, plus listed versions 10.1.18-tuxcare.110.1.18-tuxcare.2	10.1.18-tuxcare.3
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven From an advisory covering 17 CVEs	10.1.33 up to 10.1.33-tuxcare.1	10.1.33-tuxcare.1
`org.apache.tomcat:tomcat` TuxCare:Maven From an advisory covering 17 CVEs	10.1.33 up to 10.1.33-tuxcare.1	10.1.33-tuxcare.1
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven From an advisory covering 17 CVEs	10.1.33 up to 10.1.33-tuxcare.1	10.1.33-tuxcare.1
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven From an advisory covering 17 CVEs	10.1.33 up to 10.1.33-tuxcare.1	10.1.33-tuxcare.1
`org.apache.tomcat:tomcat-coyote-ffm` TuxCare:Maven From an advisory covering 17 CVEs	10.1.33 up to 10.1.33-tuxcare.1	10.1.33-tuxcare.1
`org.apache.tomcat:tomcat-tribes` TuxCare:Maven From an advisory covering 17 CVEs	10.1.33 up to 10.1.33-tuxcare.1	10.1.33-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven From an advisory covering 15 CVEs	10.1.16 up to 10.1.16-tuxcare.1	10.1.16-tuxcare.1
`org.apache.tomcat:tomcat` TuxCare:Maven From an advisory covering 15 CVEs	10.1.16 up to 10.1.16-tuxcare.1	10.1.16-tuxcare.1
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven From an advisory covering 15 CVEs	10.1.16 up to 10.1.16-tuxcare.1	10.1.16-tuxcare.1
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven From an advisory covering 15 CVEs	10.1.16 up to 10.1.16-tuxcare.1	10.1.16-tuxcare.1
`org.apache.tomcat:tomcat-tribes` TuxCare:Maven From an advisory covering 15 CVEs	10.1.16 up to 10.1.16-tuxcare.1	10.1.16-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven From an advisory covering 6 CVEs	10.1.50 up to 10.1.50-tuxcare.2, plus listed versions 10.1.50-tuxcare.1	10.1.50-tuxcare.2
`org.apache.tomcat:tomcat` TuxCare:Maven From an advisory covering 6 CVEs	10.1.50 up to 10.1.50-tuxcare.2, plus listed versions 10.1.50-tuxcare.1	10.1.50-tuxcare.2
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven From an advisory covering 6 CVEs	10.1.50 up to 10.1.50-tuxcare.2, plus listed versions 10.1.50-tuxcare.1	10.1.50-tuxcare.2
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven From an advisory covering 6 CVEs	10.1.50 up to 10.1.50-tuxcare.2, plus listed versions 10.1.50-tuxcare.1	10.1.50-tuxcare.2
`org.apache.tomcat:tomcat-coyote-ffm` TuxCare:Maven From an advisory covering 6 CVEs	10.1.50 up to 10.1.50-tuxcare.2, plus listed versions 10.1.50-tuxcare.1	10.1.50-tuxcare.2
`org.apache.tomcat:tomcat-tribes` TuxCare:Maven From an advisory covering 6 CVEs	10.1.50 up to 10.1.50-tuxcare.2, plus listed versions 10.1.50-tuxcare.1	10.1.50-tuxcare.2
`tomcat10` Debian:12	before 10.1.55-1~deb12u1, plus listed versions 10.1.10-110.1.13-110.1.14-110.1.15-110.1.16-1 Show 28 moreShow less 10.1.20-110.1.23-110.1.25-110.1.25-1~bpo12+110.1.25-210.1.30-110.1.30-1~bpo12+110.1.31-110.1.33-110.1.33-1~bpo12+110.1.34-0+deb12u110.1.34-0+deb12u210.1.34-110.1.35-110.1.40-110.1.40-1~bpo12+110.1.46-110.1.52-110.1.52-1~deb12u110.1.52-1~deb13u110.1.52-210.1.54-110.1.6-110.1.6-1+deb12u110.1.6-1+deb12u210.1.7-110.1.8-110.1.9-1	10.1.55-1~deb12u1
`tomcat10` Debian:13	before 10.1.55-1~deb13u1, plus listed versions 10.1.40-110.1.46-110.1.52-110.1.52-1~deb12u110.1.52-1~deb13u110.1.52-210.1.54-110.1.55-1~deb12u1	10.1.55-1~deb13u1
`tomcat10` Debian:14	before 10.1.54-1, plus listed versions 10.1.40-110.1.46-110.1.52-110.1.52-1~deb12u110.1.52-1~deb13u110.1.52-2	10.1.54-1
`tomcat11` Debian:13	before 11.0.22-1~deb13u1, plus listed versions 11.0.11-111.0.15-111.0.15-1~deb13u111.0.18-111.0.21-111.0.6-1	11.0.22-1~deb13u1
`tomcat11` Debian:14	before 11.0.21-1, plus listed versions 11.0.11-111.0.15-111.0.15-1~deb13u111.0.18-111.0.6-1	11.0.21-1
`tomcat9` Debian:12	before 9.0.70-2	9.0.70-2
`tomcat9` Debian:13	before 9.0.70-2	9.0.70-2
`tomcat9` Debian:14	before 9.0.70-2	9.0.70-2
`org.apache.tomcat:tomcat-coyote-ffm` Maven	9.0.83 up to 9.0.116, plus listed versions 9.0.1009.0.1029.0.1049.0.1059.0.106 Show 15 moreShow less 9.0.1079.0.1089.0.1099.0.1109.0.1119.0.1129.0.1139.0.1159.0.939.0.949.0.959.0.969.0.979.0.989.0.99	9.0.116
`org.apache.tomcat:tomcat-coyote-ffm` Maven	10.1.0-M7 up to 10.1.53, plus listed versions 10.1.2610.1.2810.1.2910.1.3010.1.31 Show 17 moreShow less 10.1.3310.1.3410.1.3510.1.3610.1.3910.1.4010.1.4110.1.4210.1.4310.1.4410.1.4510.1.4610.1.4710.1.4810.1.4910.1.5010.1.52	10.1.53
`org.apache.tomcat:tomcat-coyote-ffm` Maven	11.0.0-M1 up to 11.0.20, plus listed versions 11.0.011.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M26 Show 16 moreShow less 11.0.111.0.1011.0.1111.0.1211.0.1311.0.1411.0.1511.0.1811.0.211.0.311.0.411.0.511.0.611.0.711.0.811.0.9	11.0.20
`org.apache.tomcat:tomcat` Maven	9.0.83 up to 9.0.116, plus listed versions 9.0.1009.0.1029.0.1049.0.1059.0.106 Show 23 moreShow less 9.0.1079.0.1089.0.1099.0.1109.0.1119.0.1129.0.1139.0.1159.0.849.0.859.0.869.0.879.0.889.0.899.0.909.0.919.0.939.0.949.0.959.0.969.0.979.0.989.0.99	9.0.116
`org.apache.tomcat:tomcat` Maven	10.1.0-M7 up to 10.1.53, plus listed versions 10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14 Show 45 moreShow less 10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.3910.1.410.1.4010.1.4110.1.4210.1.4310.1.4410.1.4510.1.4610.1.4710.1.4810.1.4910.1.510.1.5010.1.5210.1.6	10.1.53
`org.apache.tomcat:tomcat` Maven	11.0.0-M1 up to 11.0.20, plus listed versions 11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13 Show 34 moreShow less 11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.1011.0.1111.0.1211.0.1311.0.1411.0.1511.0.1811.0.211.0.311.0.411.0.511.0.611.0.711.0.811.0.9	11.0.20
`tomcat` Mageia:9 From an advisory covering 10 CVEs	before 9.0.117-1.mga9	9.0.117-1.mga9
`tomcat` openEuler:24.03-LTS-SP3 From an advisory covering 10 CVEs	before 9.0.117-1.oe2403sp3	9.0.117-1.oe2403sp3
`tomcat` openEuler:20.03-LTS-SP4 From an advisory covering 10 CVEs	before 9.0.117-1.oe2003sp4	9.0.117-1.oe2003sp4
`tomcat` openEuler:22.03-LTS-SP4 From an advisory covering 10 CVEs	before 9.0.117-1.oe2203sp4	9.0.117-1.oe2203sp4
`tomcat` openEuler:24.03-LTS From an advisory covering 10 CVEs	before 9.0.117-1.oe2403sp2	9.0.117-1.oe2403sp2
`tomcat` openEuler:24.03-LTS-SP1 From an advisory covering 10 CVEs	before 9.0.117-1.oe2403sp1	9.0.117-1.oe2403sp1
`tomcat` openEuler:24.03-LTS-SP2 From an advisory covering 10 CVEs	before 9.0.117-1.oe2403sp2	9.0.117-1.oe2403sp2
`jws6-tomcat` Red Hat:jboss_enterprise_web_server:6.2::el10 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-admin-webapps` Red Hat:jboss_enterprise_web_server:6.2::el10 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-docs-webapp` Red Hat:jboss_enterprise_web_server:6.2::el10 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-el-5.0-api` Red Hat:jboss_enterprise_web_server:6.2::el10 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-javadoc` Red Hat:jboss_enterprise_web_server:6.2::el10 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-jsp-3.1-api` Red Hat:jboss_enterprise_web_server:6.2::el10 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-lib` Red Hat:jboss_enterprise_web_server:6.2::el10 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-selinux` Red Hat:jboss_enterprise_web_server:6.2::el10 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-servlet-6.0-api` Red Hat:jboss_enterprise_web_server:6.2::el10 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-webapps` Red Hat:jboss_enterprise_web_server:6.2::el10 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat` Red Hat:jboss_enterprise_web_server:6.2::el8 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-admin-webapps` Red Hat:jboss_enterprise_web_server:6.2::el8 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-docs-webapp` Red Hat:jboss_enterprise_web_server:6.2::el8 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-el-5.0-api` Red Hat:jboss_enterprise_web_server:6.2::el8 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-javadoc` Red Hat:jboss_enterprise_web_server:6.2::el8 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-jsp-3.1-api` Red Hat:jboss_enterprise_web_server:6.2::el8 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-lib` Red Hat:jboss_enterprise_web_server:6.2::el8 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-selinux` Red Hat:jboss_enterprise_web_server:6.2::el8 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-servlet-6.0-api` Red Hat:jboss_enterprise_web_server:6.2::el8 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-webapps` Red Hat:jboss_enterprise_web_server:6.2::el8 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat` Red Hat:jboss_enterprise_web_server:6.2::el9 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-admin-webapps` Red Hat:jboss_enterprise_web_server:6.2::el9 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-docs-webapp` Red Hat:jboss_enterprise_web_server:6.2::el9 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-el-5.0-api` Red Hat:jboss_enterprise_web_server:6.2::el9 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-javadoc` Red Hat:jboss_enterprise_web_server:6.2::el9 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-jsp-3.1-api` Red Hat:jboss_enterprise_web_server:6.2::el9 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-lib` Red Hat:jboss_enterprise_web_server:6.2::el9 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-selinux` Red Hat:jboss_enterprise_web_server:6.2::el9 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-servlet-6.0-api` Red Hat:jboss_enterprise_web_server:6.2::el9 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-webapps` Red Hat:jboss_enterprise_web_server:6.2::el9 From an advisory covering 7 CVEs	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`tomcat` Red Hat:enterprise_linux:9::appstream From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-admin-webapps` Red Hat:enterprise_linux:9::appstream From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-docs-webapp` Red Hat:enterprise_linux:9::appstream From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-el-3.0-api` Red Hat:enterprise_linux:9::appstream From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-jsp-2.3-api` Red Hat:enterprise_linux:9::appstream From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-lib` Red Hat:enterprise_linux:9::appstream From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-servlet-4.0-api` Red Hat:enterprise_linux:9::appstream From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-webapps` Red Hat:enterprise_linux:9::appstream From an advisory covering 9 CVEs	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat9` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 30 CVEs	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-admin-webapps` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 30 CVEs	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-docs-webapp` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 30 CVEs	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-el-3.0-api` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 30 CVEs	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-jsp-2.3-api` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 30 CVEs	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-lib` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 30 CVEs	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-servlet-4.0-api` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 30 CVEs	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-webapps` Red Hat:enterprise_linux_eus:10.0 From an advisory covering 30 CVEs	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat` Red Hat:rhel_eus:9.6::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-admin-webapps` Red Hat:rhel_eus:9.6::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-docs-webapp` Red Hat:rhel_eus:9.6::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-el-3.0-api` Red Hat:rhel_eus:9.6::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-jsp-2.3-api` Red Hat:rhel_eus:9.6::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-lib` Red Hat:rhel_eus:9.6::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-servlet-4.0-api` Red Hat:rhel_eus:9.6::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-webapps` Red Hat:rhel_eus:9.6::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-admin-webapps` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-docs-webapp` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-el-3.0-api` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-jsp-2.3-api` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-lib` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-servlet-4.0-api` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-webapps` Red Hat:enterprise_linux:8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-admin-webapps` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-docs-webapp` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-el-3.0-api` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-jsp-2.3-api` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-lib` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-servlet-4.0-api` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-webapps` Red Hat:rhel_e4s:9.2::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-admin-webapps` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-docs-webapp` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-el-3.0-api` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-jsp-2.3-api` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-lib` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-servlet-4.0-api` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-webapps` Red Hat:rhel_e4s:9.4::appstream From an advisory covering 30 CVEs	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-admin-webapps` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-docs-webapp` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-el-3.0-api` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-jsp-2.3-api` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-lib` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-servlet-4.0-api` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-webapps` Red Hat:rhel_e4s:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat` Red Hat:rhel_tus:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-admin-webapps` Red Hat:rhel_tus:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-docs-webapp` Red Hat:rhel_tus:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-el-3.0-api` Red Hat:rhel_tus:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-jsp-2.3-api` Red Hat:rhel_tus:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-lib` Red Hat:rhel_tus:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-servlet-4.0-api` Red Hat:rhel_tus:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-webapps` Red Hat:rhel_tus:8.8::appstream From an advisory covering 29 CVEs	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat9` Rocky Linux:10 From an advisory covering 9 CVEs	before 1:9.0.117-1.el10_2	1:9.0.117-1.el10_2
`io.root.org.apache.tomcat:tomcat-catalina` Root:Maven	before 11.0.11-root.io.3	11.0.11-root.io.311.0.11-root.io.4
`io.root.org.apache.tomcat.embed:tomcat-embed-core` Root:Maven	before 10.1.39-root.io.5	10.1.39-root.io.510.1.39-root.io.610.1.39-root.io.710.1.39-root.io.810.1.39-root.io.910.1.39-root.io.1010.1.39-root.io.1110.1.39-root.io.1210.1.34-root.io.110.1.34-root.io.210.1.39-root.io.1310.1.39-root.io.1410.1.39-root.io.1510.1.34-root.io.310.1.16-root.io.810.1.39-root.io.1810.1.16-root.io.910.1.39-root.io.1610.1.16-root.io.1010.1.39-root.io.1710.1.34-root.io.510.1.30-root.io.1010.1.34-root.io.610.1.16-root.io.1110.1.39-root.io.1910.1.30-root.io.1110.1.30-root.io.1210.1.16-root.io.1210.1.39-root.io.2010.1.30-root.io.1310.1.34-root.io.7
`org.apache.tomcat:tomcat-catalina` Root:Maven	before 11.0.11-aikido.4	11.0.11-aikido.4
`org.apache.tomcat.embed:tomcat-embed-core` Root:Maven	before 10.1.16-aikido.9	10.1.16-aikido.910.1.39-aikido.1610.1.16-aikido.1010.1.39-aikido.1710.1.34-aikido.510.1.39-aikido.1810.1.30-aikido.1010.1.34-aikido.610.1.16-aikido.1110.1.39-aikido.1910.1.30-aikido.1110.1.30-aikido.1210.1.16-aikido.1210.1.39-aikido.2010.1.30-aikido.1310.1.34-aikido.7
`tomcat11` SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 From an advisory covering 11 CVEs	before 11.0.21-150600.13.18.1	11.0.21-150600.13.18.1
`tomcat11` SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 11 CVEs	before 11.0.21-150600.13.18.1	11.0.21-150600.13.18.1
`tomcat11` SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 11 CVEs	before 11.0.21-150600.13.18.1	11.0.21-150600.13.18.1
`tomcat` SUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 11 CVEs	before 9.0.117-3.163.2	9.0.117-3.163.2
`tomcat` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 11 CVEs	before 9.0.117-3.163.2	9.0.117-3.163.2
`tomcat10` SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 From an advisory covering 11 CVEs	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat10` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 11 CVEs	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat10` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 11 CVEs	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat10` SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 11 CVEs	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat10` SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 11 CVEs	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat10` SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 11 CVEs	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat10` SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 11 CVEs	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat` SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 From an advisory covering 11 CVEs	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 11 CVEs	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 11 CVEs	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 11 CVEs	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 11 CVEs	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 11 CVEs	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 11 CVEs	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 11 CVEs	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 11 CVEs	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 11 CVEs	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 11 CVEs	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat10` Ubuntu:24.04:LTS	All versions, plus listed versions 10.1.10-110.1.14-110.1.15-110.1.16-110.1.16-1ubuntu0.1~esm1 Show 4 moreShow less 10.1.16-1ubuntu0.1~esm210.1.16-1ubuntu0.1~esm310.1.16-1ubuntu0.1~esm410.1.55-1ubuntu2~24.04.1	None known
`tomcat10` Ubuntu:25.10	All versions, plus listed versions 10.1.35-110.1.40-110.1.40-1ubuntu110.1.40-1ubuntu1.25.10.1	None known
`tomcat11` Ubuntu:25.10	All versions, plus listed versions 11.0.6-1	None known
`tomcat9` Ubuntu:25.10	All versions, plus listed versions 9.0.70-2ubuntu1.19.0.70-2ubuntu29.0.70-2ubuntu39.0.95-1ubuntu19.0.95-1ubuntu1.1	None known
`tomcat10` Ubuntu:26.04:LTS	All versions, plus listed versions 10.1.40-1ubuntu110.1.40-1ubuntu1.26.04.110.1.55-1ubuntu2~26.04.1	None known
`tomcat9` Ubuntu:26.04:LTS	All versions, plus listed versions 9.0.95-1ubuntu19.0.111-19.0.115-19.0.115-1ubuntu0.19.0.118-1~26.04.1	None known
`tomcat11` Ubuntu:26.04:LTS	All versions, plus listed versions 11.0.6-111.0.11-111.0.15-111.0.18-111.0.18-1ubuntu0.1~esm111.0.22-2ubuntu2~26.04.1	None known
`tomcat` openSUSE:Tumbleweed From an advisory covering 10 CVEs	before 9.0.117-1.1	9.0.117-1.1
`tomcat10` openSUSE:Tumbleweed From an advisory covering 10 CVEs	before 10.1.54-1.1	10.1.54-1.1
`tomcat11` openSUSE:Tumbleweed From an advisory covering 10 CVEs	before 11.0.21-1.1	11.0.21-1.1
`tomcat11` openSUSE:Leap 16.0 From an advisory covering 11 CVEs	before 11.0.21-160000.1.1	11.0.21-160000.1.1
`tomcat` openSUSE:Leap 16.0 From an advisory covering 11 CVEs	before 9.0.117-160000.1.1	9.0.117-160000.1.1
`tomcat10` openSUSE:Leap 16.0 From an advisory covering 11 CVEs	before 10.1.54-160000.1.1	10.1.54-160000.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	gregk4sec/cve-2026-29145	2026-03-08
PoC in GitHub	sancliffe/CVE-2026-29145-Tester	2026-04-23
PoC in GitHub	Chenjp/CVE-2026-29145-Tester	2026-05-08
PoC in GitHub	gkdgkd123/CVE-2026-29145-Everything	2026-07-11

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, exploits, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-29145 is a critical vulnerability (CVSS 9.1) in Apache Tomcat, published April 9, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in org.apache.tomcat:tomcat 9.0.116.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 3 versions, 103 references and the rest of 1 source description. The JSON record has them.