CVE-2026-24880

Apache Tomcat: Request smuggling via invalid chunk extension

7.5 HighPublic exploitFix available

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.70%Up 0.7 points since Apr 10, 2026

What each source reports

CVE List Score used 7.5

Apache Tomcat: Request smuggling via invalid chunk extension

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

Record: CVE-2026-24880
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-444
Updated: 2026-11-02

EUVDEUVD-2026-21006 7.5

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

Record: EUVD-2026-21006
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-563x-q5rq-57qp 7.5

Apache Tomcat has an HTTP Request/Response Smuggling vulnerability

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

Record: GHSA-563x-q5rq-57qp
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-444
Updated: 2026-11-02

NVD 7.5

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

Record: CVE-2026-24880
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-444
Updated: 2026-11-02

OSV 7.5

Apache Tomcat: Request smuggling via invalid chunk extension

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

Record: CVE-2026-24880
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-444
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-24880 7.5

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

Record: DEBIAN-CVE-2026-24880
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Show 43 moreShow less

OSVGHSA-563x-q5rq-57qp 7.5

Apache Tomcat has an HTTP Request/Response Smuggling vulnerability

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

Record: GHSA-563x-q5rq-57qp
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-444
Updated: 2026-11-02

OSVOESA-2026-1970 9.1

tomcat security update

Security Fix(es):

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.(CVE-2026-24880)

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-25854)

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-29129)

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.(CVE-2026-29145)

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.(CVE-2026-29146)

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-32990)

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.(CVE-2026-34483)

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.(CVE-2026-34486)

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.(CVE-2026-34487)

CLIENT_CERT authentication does not fail as expected for some…

Record: OESA-2026-1970
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:20405 7.5

Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.3 release and security update

Record: RHSA-2026:20405
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:26323 7.4

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:26323
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:67163 7.5

Red Hat Security Advisory: tomcat9 security update

Record: RHSA-2026:67163
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68659 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68659
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68677 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68677
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68678 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68678
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68679 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68679
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68680 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68680
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:25341 7.4

Important: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)
tomcat: Client certificate verification bypass due to virtual host mapping (CVE-2025-66614)
tomcat: security constraint bypass with HTTP/0.9 (CVE-2026-24733)
Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration (CVE-2026-29145)
Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files (CVE-2026-34487)
Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve (CVE-2026-25854)
Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension (CVE-2026-24880)
Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration (CVE-2026-34500)
Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve (CVE-2026-34483)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:25341
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2026-24880 7.5

CVE-2026-24880 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-24880 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2026-24880
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-24880 7.5

Record: UBUNTU-CVE-2026-24880
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVALSA-2026:25341 No score

Important: tomcat9 update

Certificate revocation bypass due to improper OCSP response validation

Record: ALSA-2026:25341
Updated: 2026-11-02

OSVALSA-2026:26323 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:26323
Updated: 2026-11-02

OSVALSA-2026:36790 No score

Important: tomcat9 security, bug fix, and enhancement update

Security Fix(es):

Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)
Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-185571)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:36790
Updated: 2026-11-02

OSVALSA-2026:68677 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)
tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:68677
Updated: 2026-11-02

OSVBIT-tomcat-2026-24880 No score

Apache Tomcat: Request smuggling via invalid chunk extension

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.18, from 10.1.0 through 10.1.52, from 9.0.0 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.

Record: BIT-tomcat-2026-24880
Updated: 2026-11-02

OSVCLSA-2026-1776386118 No score

TuxCare security update for 4 packages (4 CVEs)

TuxCare rebuilt 4 packages to address 4 CVEs. Fixed in 10.1.42-tuxcare.2.

Record: CLSA-2026-1776386118
Updated: 2026-11-02

OSVCLSA-2026-1777163890 No score

TuxCare security update for 3 packages (2 CVEs)

TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.0.100-tuxcare.6.

Record: CLSA-2026-1777163890
Updated: 2026-11-02

OSVCLSA-2026-1777941828 No score

TuxCare security update for 4 packages (2 CVEs)

TuxCare rebuilt 4 packages to address 2 CVEs. Fixed in 9.0.90-tuxcare.7.

Record: CLSA-2026-1777941828
Updated: 2026-11-02

OSVCLSA-2026-1778546710 No score

TuxCare security update for 2 packages (1 CVE)

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 7.0.109-tuxcare.1.

Record: CLSA-2026-1778546710
Updated: 2026-11-02

OSVCLSA-2026-1778633134 No score

TuxCare security update for 2 packages (1 CVE)

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 8.5.100-tuxcare.10.

Record: CLSA-2026-1778633134
Updated: 2026-11-02

OSVCLSA-2026-1786121727 No score

tomcat: Fix of 8 CVEs

CVE-2026-24880: validate HTTP/1.1 chunk extensions with a new ChunkExtension state machine instead of skipping them unparsed, so a CRLF embedded in a quoted extension value can no longer desync Tomcat from a front-end proxy and smuggle a request
CVE-2026-25854: collapse leading slashes on the request URI and redirect via sendRedirect in the LoadBalancerDrainingValve so a protocol-relative URI can no longer be reflected into the Location header as an open redirect
CVE-2026-34483: escape the request URI and query string in the access log %r, %q and %U elements so log fields cannot be forged through unescaped output
CVE-2026-34487: stop logging the Kubernetes bearer token by dropping it from the tokenStream.failedConnection message and dropping the request headers from the cloud stream provider debug log

Record: CLSA-2026-1786121727
Updated: 2026-11-02

OSVCLSA-2026-1792667085 No score

TuxCare security update for 7 packages (24 CVEs)

TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.

Record: CLSA-2026-1792667085
Updated: 2026-11-02

OSVCLSA-2026-1792686128 No score

TuxCare security update for 7 packages (13 CVEs)

TuxCare rebuilt 7 packages to address 13 CVEs. Fixed in 8.5.78-tuxcare.1.

Record: CLSA-2026-1792686128
Updated: 2026-11-02

OSVCLSA-2026-1792765354 No score

TuxCare security update for 6 packages (6 CVEs)

TuxCare rebuilt 6 packages to address 6 CVEs. Fixed in 10.1.50-tuxcare.2.

Record: CLSA-2026-1792765354
Updated: 2026-11-02

OSVCLSA-2026-1793727391 No score

TuxCare security update for 5 packages (8 CVEs)

TuxCare rebuilt 5 packages to address 8 CVEs. Fixed in 10.1.33-tuxcare.3.

Record: CLSA-2026-1793727391
Updated: 2026-11-04

OSVCLSA-2026-1793730417 No score

TuxCare security update for 4 packages (3 CVEs)

TuxCare rebuilt 4 packages to address 3 CVEs. Fixed in 10.1.18-tuxcare.10.

Record: CLSA-2026-1793730417
Updated: 2026-11-04

OSVMGASA-2026-0095 No score

Updated tomcat packages fix security vulnerabilities

Request smuggling via invalid chunk extension. (CVE-2026-24880) Occasionally open redirect. (CVE-2026-25854) TLS cipher order is not preserved. (CVE-2026-29129) OCSP checks sometimes soft-fail even when soft-fail is disabled. (CVE-2026-29145) EncryptInterceptor vulnerable to padding oracle attack by default. (CVE-2026-29146) Fix for CVE-2025-66614 is incomplete. (CVE-2026-32990) Incomplete escaping of JSON access logs. (CVE-2026-34483) Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor. (CVE-2026-34486) Cloud membership for clustering component exposed the Kubernetes bearer token. (CVE-2026-34487) OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled. (CVE-2026-34500)

Record: MGASA-2026-0095
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10547-1 No score

tomcat-9.0.117-1.1 on GA media

These are all security issues fixed in the tomcat-9.0.117-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10547-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10548-1 No score

tomcat10-10.1.54-1.1 on GA media

These are all security issues fixed in the tomcat10-10.1.54-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10548-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10549-1 No score

tomcat11-11.0.21-1.1 on GA media

These are all security issues fixed in the tomcat11-11.0.21-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10549-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20595-1 No score

Security update for tomcat11

This update for tomcat11 fixes the following issues:

Update to Tomcat 11.0.21
CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Record: openSUSE-SU-2026:20595-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20611-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Record: openSUSE-SU-2026:20611-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20612-1 No score

Security update for tomcat10

This update for tomcat10 fixes the following issues:

Update to Tomcat 10.1.54
CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Record: openSUSE-SU-2026:20612-1
Updated: 2026-11-02

OSVSUSE-SU-2026:1558-1 No score

Security update for tomcat11

This update for tomcat11 fixes the following issues:

Security fixes:

CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

Update to Tomcat 11.0.21

Record: SUSE-SU-2026:1558-1
Updated: 2026-11-02

OSVSUSE-SU-2026:1572-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

Security fixes:

CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

Update to Tomcat 9.0.117

Record: SUSE-SU-2026:1572-1
Updated: 2026-11-02

OSVSUSE-SU-2026:1603-1 No score

Security update for tomcat10

This update for tomcat10 fixes the following issues:

Security fixes:

CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

Update to Tomcat 10.1.54

Record: SUSE-SU-2026:1603-1
Updated: 2026-11-02

OSVSUSE-SU-2026:1604-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

Security fixes:

CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

Update to Tomcat 9.0.117

Record: SUSE-SU-2026:1604-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21366-1 No score

Security update for tomcat11

This update for tomcat11 fixes the following issues:

Update to Tomcat 11.0.21
CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Record: SUSE-SU-2026:21366-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21378-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Record: SUSE-SU-2026:21378-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21379-1 No score

Security update for tomcat10

This update for tomcat10 fixes the following issues:

Update to Tomcat 10.1.54
CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
CVE-2026-25854: Occasionally open redirect (bsc#1261851).
CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Record: SUSE-SU-2026:21379-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.tomcat:tomcat-coyote` Maven	7.0.0 up to 9.0.116	9.0.116
`org.apache.tomcat:tomcat-coyote` Maven	10.1.0-M1 up to 10.1.52	10.1.52
`org.apache.tomcat:tomcat-coyote` Maven	11.0.0-M1 to 11.0.18	11.0.20
`org.apache.tomcat.embed:tomcat-embed-core` Maven	7.0.0 up to 9.0.116	9.0.116
`org.apache.tomcat.embed:tomcat-embed-core` Maven	10.1.0-M1 up to 10.1.52	10.1.52
`org.apache.tomcat.embed:tomcat-embed-core` Maven	11.0.0-M1 to 11.0.18	11.0.20
`tomcat9` AlmaLinux:10	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat9-admin-webapps` AlmaLinux:10	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat9-docs-webapp` AlmaLinux:10	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat9-el-3.0-api` AlmaLinux:10	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1

Show 246 moreShow less

Affected packages
Package	Affected	Fixed
`tomcat9-jsp-2.3-api` AlmaLinux:10	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat9-lib` AlmaLinux:10	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat9-servlet-4.0-api` AlmaLinux:10	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat9-webapps` AlmaLinux:10	before 1:9.0.117-1.el10_2.alma.1	1:9.0.117-1.el10_2.alma.1
`tomcat` AlmaLinux:9	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-admin-webapps` AlmaLinux:9	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-docs-webapp` AlmaLinux:9	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-el-3.0-api` AlmaLinux:9	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-jsp-2.3-api` AlmaLinux:9	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-lib` AlmaLinux:9	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-servlet-4.0-api` AlmaLinux:9	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-webapps` AlmaLinux:9	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat9` AlmaLinux:10	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-admin-webapps` AlmaLinux:10	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-docs-webapp` AlmaLinux:10	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-el-3.0-api` AlmaLinux:10	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-jsp-2.3-api` AlmaLinux:10	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-lib` AlmaLinux:10	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-servlet-4.0-api` AlmaLinux:10	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat9-webapps` AlmaLinux:10	before 1:9.0.117-2.el10_2.alma.1	1:9.0.117-2.el10_2.alma.1
`tomcat` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-admin-webapps` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-docs-webapp` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-el-3.0-api` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-jsp-2.3-api` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-lib` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-servlet-4.0-api` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-webapps` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat` Bitnami	before 9.0.116, 10.0.0 up to 10.1.53, 11.0.0 up to 11.0.20	9.0.11610.1.5311.0.20
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	10.1.42 up to 10.1.42-tuxcare.2, plus listed versions 10.1.42-tuxcare.1	10.1.42-tuxcare.2
`org.apache.tomcat:tomcat` TuxCare:Maven	10.1.42 up to 10.1.42-tuxcare.2, plus listed versions 10.1.42-tuxcare.1	10.1.42-tuxcare.2
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	10.1.42 up to 10.1.42-tuxcare.2, plus listed versions 10.1.42-tuxcare.1	10.1.42-tuxcare.2
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	10.1.42 up to 10.1.42-tuxcare.2, plus listed versions 10.1.42-tuxcare.1	10.1.42-tuxcare.2
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	9.0.100 up to 9.0.100-tuxcare.6, plus listed versions 9.0.100-tuxcare.19.0.100-tuxcare.29.0.100-tuxcare.39.0.100-tuxcare.49.0.100-tuxcare.5	9.0.100-tuxcare.6
`org.apache.tomcat:tomcat` TuxCare:Maven	9.0.100 up to 9.0.100-tuxcare.6, plus listed versions 9.0.100-tuxcare.19.0.100-tuxcare.29.0.100-tuxcare.39.0.100-tuxcare.49.0.100-tuxcare.5	9.0.100-tuxcare.6
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	9.0.100 up to 9.0.100-tuxcare.6, plus listed versions 9.0.100-tuxcare.19.0.100-tuxcare.29.0.100-tuxcare.39.0.100-tuxcare.49.0.100-tuxcare.5	9.0.100-tuxcare.6
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	9.0.90 up to 9.0.90-tuxcare.7, plus listed versions 9.0.90-tuxcare.19.0.90-tuxcare.29.0.90-tuxcare.39.0.90-tuxcare.49.0.90-tuxcare.59.0.90-tuxcare.6	9.0.90-tuxcare.7
`org.apache.tomcat:tomcat` TuxCare:Maven	9.0.90 up to 9.0.90-tuxcare.7, plus listed versions 9.0.90-tuxcare.19.0.90-tuxcare.29.0.90-tuxcare.39.0.90-tuxcare.49.0.90-tuxcare.59.0.90-tuxcare.6	9.0.90-tuxcare.7
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	9.0.90 up to 9.0.90-tuxcare.7, plus listed versions 9.0.90-tuxcare.19.0.90-tuxcare.29.0.90-tuxcare.39.0.90-tuxcare.49.0.90-tuxcare.59.0.90-tuxcare.6	9.0.90-tuxcare.7
`org.apache.tomcat:tomcat-tribes` TuxCare:Maven	9.0.90 up to 9.0.90-tuxcare.7, plus listed versions 9.0.90-tuxcare.19.0.90-tuxcare.29.0.90-tuxcare.39.0.90-tuxcare.49.0.90-tuxcare.59.0.90-tuxcare.6	9.0.90-tuxcare.7
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	7.0.109 up to 7.0.109-tuxcare.1	7.0.109-tuxcare.1
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	7.0.109 up to 7.0.109-tuxcare.1	7.0.109-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	8.5.100 up to 8.5.100-tuxcare.10, plus listed versions 8.5.100-tuxcare.38.5.100-tuxcare.48.5.100-tuxcare.58.5.100-tuxcare.68.5.100-tuxcare.7 Show 4 moreShow less 8.5.100-tuxcare.88.5.100-tuxcare.98.5.100.tuxcare.18.5.100.tuxcare.2	8.5.100-tuxcare.10
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	8.5.100 up to 8.5.100-tuxcare.10, plus listed versions 8.5.100-tuxcare.38.5.100-tuxcare.48.5.100-tuxcare.58.5.100-tuxcare.68.5.100-tuxcare.7 Show 4 moreShow less 8.5.100-tuxcare.88.5.100-tuxcare.98.5.100.tuxcare.18.5.100.tuxcare.2	8.5.100-tuxcare.10
`tomcat` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els8	1:9.0.62-12.el9_2.1.tuxcare.els8
`tomcat-admin-webapps` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els8	1:9.0.62-12.el9_2.1.tuxcare.els8
`tomcat-docs-webapp` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els8	1:9.0.62-12.el9_2.1.tuxcare.els8
`tomcat-el-3.0-api` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els8	1:9.0.62-12.el9_2.1.tuxcare.els8
`tomcat-jsp-2.3-api` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els8	1:9.0.62-12.el9_2.1.tuxcare.els8
`tomcat-lib` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els8	1:9.0.62-12.el9_2.1.tuxcare.els8
`tomcat-servlet-4.0-api` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els8	1:9.0.62-12.el9_2.1.tuxcare.els8
`tomcat-webapps` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els8	1:9.0.62-12.el9_2.1.tuxcare.els8
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	8.5.46 up to 8.5.46-tuxcare.1	8.5.46-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-websocket` TuxCare:Maven	8.5.46 up to 8.5.46-tuxcare.1	8.5.46-tuxcare.1
`org.apache.tomcat:tomcat` TuxCare:Maven	8.5.46 up to 8.5.46-tuxcare.1	8.5.46-tuxcare.1
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	8.5.46 up to 8.5.46-tuxcare.1	8.5.46-tuxcare.1
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	8.5.46 up to 8.5.46-tuxcare.1	8.5.46-tuxcare.1
`org.apache.tomcat:tomcat-tribes` TuxCare:Maven	8.5.46 up to 8.5.46-tuxcare.1	8.5.46-tuxcare.1
`org.apache.tomcat:tomcat-websocket` TuxCare:Maven	8.5.46 up to 8.5.46-tuxcare.1	8.5.46-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	8.5.78 up to 8.5.78-tuxcare.1	8.5.78-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-websocket` TuxCare:Maven	8.5.78 up to 8.5.78-tuxcare.1	8.5.78-tuxcare.1
`org.apache.tomcat:tomcat` TuxCare:Maven	8.5.78 up to 8.5.78-tuxcare.1	8.5.78-tuxcare.1
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	8.5.78 up to 8.5.78-tuxcare.1	8.5.78-tuxcare.1
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	8.5.78 up to 8.5.78-tuxcare.1	8.5.78-tuxcare.1
`org.apache.tomcat:tomcat-tribes` TuxCare:Maven	8.5.78 up to 8.5.78-tuxcare.1	8.5.78-tuxcare.1
`org.apache.tomcat:tomcat-websocket` TuxCare:Maven	8.5.78 up to 8.5.78-tuxcare.1	8.5.78-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	10.1.50 up to 10.1.50-tuxcare.2, plus listed versions 10.1.50-tuxcare.1	10.1.50-tuxcare.2
`org.apache.tomcat:tomcat` TuxCare:Maven	10.1.50 up to 10.1.50-tuxcare.2, plus listed versions 10.1.50-tuxcare.1	10.1.50-tuxcare.2
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	10.1.50 up to 10.1.50-tuxcare.2, plus listed versions 10.1.50-tuxcare.1	10.1.50-tuxcare.2
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	10.1.50 up to 10.1.50-tuxcare.2, plus listed versions 10.1.50-tuxcare.1	10.1.50-tuxcare.2
`org.apache.tomcat:tomcat-coyote-ffm` TuxCare:Maven	10.1.50 up to 10.1.50-tuxcare.2, plus listed versions 10.1.50-tuxcare.1	10.1.50-tuxcare.2
`org.apache.tomcat:tomcat-tribes` TuxCare:Maven	10.1.50 up to 10.1.50-tuxcare.2, plus listed versions 10.1.50-tuxcare.1	10.1.50-tuxcare.2
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	10.1.33 up to 10.1.33-tuxcare.3, plus listed versions 10.1.33-tuxcare.110.1.33-tuxcare.2	10.1.33-tuxcare.3
`org.apache.tomcat:tomcat` TuxCare:Maven	10.1.33 up to 10.1.33-tuxcare.3, plus listed versions 10.1.33-tuxcare.110.1.33-tuxcare.2	10.1.33-tuxcare.3
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	10.1.33 up to 10.1.33-tuxcare.3, plus listed versions 10.1.33-tuxcare.110.1.33-tuxcare.2	10.1.33-tuxcare.3
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	10.1.33 up to 10.1.33-tuxcare.3, plus listed versions 10.1.33-tuxcare.110.1.33-tuxcare.2	10.1.33-tuxcare.3
`org.apache.tomcat:tomcat-tribes` TuxCare:Maven	10.1.33 up to 10.1.33-tuxcare.3, plus listed versions 10.1.33-tuxcare.110.1.33-tuxcare.2	10.1.33-tuxcare.3
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	10.1.18 up to 10.1.18-tuxcare.10, plus listed versions 10.1.18-tuxcare.110.1.18-tuxcare.210.1.18-tuxcare.310.1.18-tuxcare.410.1.18-tuxcare.5 Show 4 moreShow less 10.1.18-tuxcare.610.1.18-tuxcare.710.1.18-tuxcare.810.1.18-tuxcare.9	10.1.18-tuxcare.10
`org.apache.tomcat:tomcat` TuxCare:Maven	10.1.18 up to 10.1.18-tuxcare.10, plus listed versions 10.1.18-tuxcare.110.1.18-tuxcare.210.1.18-tuxcare.310.1.18-tuxcare.410.1.18-tuxcare.5 Show 4 moreShow less 10.1.18-tuxcare.610.1.18-tuxcare.710.1.18-tuxcare.810.1.18-tuxcare.9	10.1.18-tuxcare.10
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	10.1.18 up to 10.1.18-tuxcare.10, plus listed versions 10.1.18-tuxcare.110.1.18-tuxcare.210.1.18-tuxcare.310.1.18-tuxcare.410.1.18-tuxcare.5 Show 4 moreShow less 10.1.18-tuxcare.610.1.18-tuxcare.710.1.18-tuxcare.810.1.18-tuxcare.9	10.1.18-tuxcare.10
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	10.1.18 up to 10.1.18-tuxcare.10, plus listed versions 10.1.18-tuxcare.110.1.18-tuxcare.210.1.18-tuxcare.310.1.18-tuxcare.410.1.18-tuxcare.5 Show 4 moreShow less 10.1.18-tuxcare.610.1.18-tuxcare.710.1.18-tuxcare.810.1.18-tuxcare.9	10.1.18-tuxcare.10
`tomcat10` Debian:12	before 10.1.55-1~deb12u1, plus listed versions 10.1.10-110.1.13-110.1.14-110.1.15-110.1.16-1 Show 28 moreShow less 10.1.20-110.1.23-110.1.25-110.1.25-1~bpo12+110.1.25-210.1.30-110.1.30-1~bpo12+110.1.31-110.1.33-110.1.33-1~bpo12+110.1.34-0+deb12u110.1.34-0+deb12u210.1.34-110.1.35-110.1.40-110.1.40-1~bpo12+110.1.46-110.1.52-110.1.52-1~deb12u110.1.52-1~deb13u110.1.52-210.1.54-110.1.6-110.1.6-1+deb12u110.1.6-1+deb12u210.1.7-110.1.8-110.1.9-1	10.1.55-1~deb12u1
`tomcat10` Debian:13	before 10.1.55-1~deb13u1, plus listed versions 10.1.40-110.1.46-110.1.52-110.1.52-1~deb12u110.1.52-1~deb13u110.1.52-210.1.54-110.1.55-1~deb12u1	10.1.55-1~deb13u1
`tomcat10` Debian:14	before 10.1.54-1, plus listed versions 10.1.40-110.1.46-110.1.52-110.1.52-1~deb12u110.1.52-1~deb13u110.1.52-2	10.1.54-1
`tomcat11` Debian:13	before 11.0.22-1~deb13u1, plus listed versions 11.0.11-111.0.15-111.0.15-1~deb13u111.0.18-111.0.21-111.0.6-1	11.0.22-1~deb13u1
`tomcat11` Debian:14	before 11.0.21-1, plus listed versions 11.0.11-111.0.15-111.0.15-1~deb13u111.0.18-111.0.6-1	11.0.21-1
`tomcat9` Debian:12	before 9.0.70-2	9.0.70-2
`tomcat9` Debian:13	before 9.0.70-2	9.0.70-2
`tomcat9` Debian:14	before 9.0.70-2	9.0.70-2
`org.apache.tomcat:tomcat-coyote` Maven	7.0.0 up to 9.0.116, plus listed versions 7.0.1007.0.1037.0.1047.0.1057.0.106 Show 45 moreShow less 7.0.1077.0.1087.0.1097.0.117.0.127.0.147.0.167.0.197.0.27.0.207.0.217.0.227.0.237.0.257.0.267.0.277.0.287.0.297.0.307.0.327.0.337.0.347.0.357.0.377.0.397.0.47.0.407.0.417.0.427.0.477.0.57.0.507.0.527.0.537.0.547.0.557.0.567.0.577.0.597.0.67.0.617.0.627.0.637.0.647.0.65	9.0.116
`org.apache.tomcat:tomcat-coyote` Maven	10.1.0-M1 up to 10.1.52, plus listed versions 10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14 Show 45 moreShow less 10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.3910.1.410.1.4010.1.4110.1.4210.1.4310.1.4410.1.4510.1.4610.1.4710.1.48	10.1.52
`org.apache.tomcat:tomcat-coyote` Maven	11.0.0-M1 up to 11.0.20, plus listed versions 11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13 Show 34 moreShow less 11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.1011.0.1111.0.1211.0.1311.0.1411.0.1511.0.1811.0.211.0.311.0.411.0.511.0.611.0.711.0.811.0.9	11.0.20
`org.apache.tomcat.embed:tomcat-embed-core` Maven	7.0.0 up to 9.0.116, plus listed versions 7.0.1007.0.1037.0.1047.0.1057.0.106 Show 45 moreShow less 7.0.1077.0.1087.0.1097.0.117.0.127.0.147.0.167.0.197.0.27.0.207.0.217.0.227.0.237.0.257.0.267.0.277.0.287.0.297.0.307.0.327.0.337.0.347.0.357.0.377.0.397.0.47.0.407.0.417.0.427.0.477.0.57.0.507.0.527.0.537.0.547.0.557.0.567.0.577.0.597.0.67.0.617.0.627.0.637.0.647.0.65	9.0.116
`org.apache.tomcat.embed:tomcat-embed-core` Maven	10.1.0-M1 up to 10.1.52, plus listed versions 10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14 Show 45 moreShow less 10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.3910.1.410.1.4010.1.4110.1.4210.1.4310.1.4410.1.4510.1.4610.1.4710.1.48	10.1.52
`org.apache.tomcat.embed:tomcat-embed-core` Maven	11.0.0-M1 up to 11.0.20, plus listed versions 11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13 Show 34 moreShow less 11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.1011.0.1111.0.1211.0.1311.0.1411.0.1511.0.1811.0.211.0.311.0.411.0.511.0.611.0.711.0.811.0.9	11.0.20
`tomcat` Mageia:9	before 9.0.117-1.mga9	9.0.117-1.mga9
`tomcat` openEuler:24.03-LTS-SP3	before 9.0.117-1.oe2403sp3	9.0.117-1.oe2403sp3
`tomcat` openEuler:20.03-LTS-SP4	before 9.0.117-1.oe2003sp4	9.0.117-1.oe2003sp4
`tomcat` openEuler:22.03-LTS-SP4	before 9.0.117-1.oe2203sp4	9.0.117-1.oe2203sp4
`tomcat` openEuler:24.03-LTS	before 9.0.117-1.oe2403sp2	9.0.117-1.oe2403sp2
`tomcat` openEuler:24.03-LTS-SP1	before 9.0.117-1.oe2403sp1	9.0.117-1.oe2403sp1
`tomcat` openEuler:24.03-LTS-SP2	before 9.0.117-1.oe2403sp2	9.0.117-1.oe2403sp2
`jws6-tomcat` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-admin-webapps` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-docs-webapp` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-el-5.0-api` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-javadoc` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-jsp-3.1-api` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-lib` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-selinux` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-servlet-6.0-api` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat-webapps` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-13.redhat_00011.1.el10jws	0:10.1.49-13.redhat_00011.1.el10jws
`jws6-tomcat` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-admin-webapps` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-docs-webapp` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-el-5.0-api` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-javadoc` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-jsp-3.1-api` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-lib` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-selinux` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-servlet-6.0-api` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat-webapps` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-13.redhat_00011.1.el8jws	0:10.1.49-13.redhat_00011.1.el8jws
`jws6-tomcat` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-admin-webapps` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-docs-webapp` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-el-5.0-api` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-javadoc` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-jsp-3.1-api` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-lib` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-selinux` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-servlet-6.0-api` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`jws6-tomcat-webapps` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-13.redhat_00011.1.el9jws	0:10.1.49-13.redhat_00011.1.el9jws
`tomcat` Red Hat:enterprise_linux:9::appstream	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-admin-webapps` Red Hat:enterprise_linux:9::appstream	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-docs-webapp` Red Hat:enterprise_linux:9::appstream	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-el-3.0-api` Red Hat:enterprise_linux:9::appstream	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-jsp-2.3-api` Red Hat:enterprise_linux:9::appstream	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-lib` Red Hat:enterprise_linux:9::appstream	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-servlet-4.0-api` Red Hat:enterprise_linux:9::appstream	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat-webapps` Red Hat:enterprise_linux:9::appstream	before 1:9.0.117-1.el9_8	1:9.0.117-1.el9_8
`tomcat9` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-admin-webapps` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-docs-webapp` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-el-3.0-api` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-jsp-2.3-api` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-lib` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-servlet-4.0-api` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-webapps` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-admin-webapps` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-docs-webapp` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-el-3.0-api` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-jsp-2.3-api` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-lib` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-servlet-4.0-api` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-webapps` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-admin-webapps` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-docs-webapp` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-el-3.0-api` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-jsp-2.3-api` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-lib` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-servlet-4.0-api` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-webapps` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-admin-webapps` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-docs-webapp` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-el-3.0-api` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-jsp-2.3-api` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-lib` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-servlet-4.0-api` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-webapps` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-admin-webapps` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-docs-webapp` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-el-3.0-api` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-jsp-2.3-api` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-lib` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-servlet-4.0-api` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-webapps` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-admin-webapps` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-docs-webapp` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-el-3.0-api` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-jsp-2.3-api` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-lib` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-servlet-4.0-api` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-webapps` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-admin-webapps` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-docs-webapp` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-el-3.0-api` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-jsp-2.3-api` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-lib` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-servlet-4.0-api` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-webapps` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat9` Rocky Linux:10	before 1:9.0.117-1.el10_2	1:9.0.117-1.el10_2
`org.apache.tomcat.embed:tomcat-embed-core` Root:Maven	before 10.1.39-aikido.16	10.1.39-aikido.1610.1.30-aikido.810.1.30-aikido.910.1.16-aikido.1010.1.39-aikido.1710.1.34-aikido.510.1.39-aikido.1810.1.30-aikido.1010.1.34-aikido.69.0.74-aikido.210.1.16-aikido.1110.1.39-aikido.1910.1.30-aikido.1110.1.30-aikido.1210.1.16-aikido.1210.1.39-aikido.2010.1.30-aikido.1310.1.34-aikido.710.1.52-aikido.310.1.52-aikido.110.1.52-aikido.2
`org.apache.tomcat:tomcat-coyote` Root:Maven	before 10.1.13-aikido.12	10.1.13-aikido.12
`io.root.org.apache.tomcat.embed:tomcat-embed-core` Root:Maven	before 10.1.39-root.io.1	10.1.39-root.io.110.1.39-root.io.210.1.39-root.io.310.1.39-root.io.410.1.39-root.io.510.1.39-root.io.610.1.39-root.io.710.1.39-root.io.810.1.39-root.io.910.1.39-root.io.1010.1.39-root.io.1110.1.39-root.io.1210.1.39-root.io.1310.1.39-root.io.1410.1.39-root.io.1510.1.39-root.io.1810.1.39-root.io.1610.1.30-root.io.810.1.30-root.io.910.1.16-root.io.1010.1.39-root.io.1710.1.34-root.io.510.1.30-root.io.1010.1.34-root.io.69.0.74-root.io.210.1.16-root.io.1110.1.39-root.io.1910.1.30-root.io.1110.1.30-root.io.1210.1.16-root.io.1210.1.39-root.io.2010.1.30-root.io.1310.1.34-root.io.710.1.52-root.io.310.1.52-root.io.110.1.52-root.io.2
`io.root.org.apache.tomcat:tomcat-coyote` Root:Maven	before 10.1.13-root.io.12	10.1.13-root.io.12
`tomcat11` SUSE:Linux Enterprise Module for Web and Scripting 15 SP7	before 11.0.21-150600.13.18.1	11.0.21-150600.13.18.1
`tomcat11` SUSE:Linux Enterprise Server 15 SP6-LTSS	before 11.0.21-150600.13.18.1	11.0.21-150600.13.18.1
`tomcat11` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	before 11.0.21-150600.13.18.1	11.0.21-150600.13.18.1
`tomcat` SUSE:Linux Enterprise Server 12 SP5-LTSS	before 9.0.117-3.163.2	9.0.117-3.163.2
`tomcat` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	before 9.0.117-3.163.2	9.0.117-3.163.2
`tomcat10` SUSE:Linux Enterprise Module for Web and Scripting 15 SP7	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat10` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat10` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat10` SUSE:Linux Enterprise Server 15 SP5-LTSS	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat10` SUSE:Linux Enterprise Server 15 SP6-LTSS	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat10` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat10` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	before 10.1.54-150200.5.64.1	10.1.54-150200.5.64.1
`tomcat` SUSE:Linux Enterprise Module for Web and Scripting 15 SP7	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise Server 15 SP4-LTSS	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise Server 15 SP5-LTSS	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise Server 15 SP6-LTSS	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	before 9.0.117-150200.105.1	9.0.117-150200.105.1
`tomcat6` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 6.0.37-16.0.39-16.0.39-1ubuntu0.16.0.39-1ubuntu0.1+esm16.0.39-1ubuntu0.1+esm26.0.39-1ubuntu0.1+esm3	None known
`tomcat7` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 7.0.42-17.0.47-17.0.50-17.0.52-17.0.52-1ubuntu0.1 Show 13 moreShow less 7.0.52-1ubuntu0.37.0.52-1ubuntu0.67.0.52-1ubuntu0.77.0.52-1ubuntu0.87.0.52-1ubuntu0.97.0.52-1ubuntu0.107.0.52-1ubuntu0.117.0.52-1ubuntu0.137.0.52-1ubuntu0.147.0.52-1ubuntu0.157.0.52-1ubuntu0.167.0.52-1ubuntu0.16+esm17.0.52-1ubuntu0.16+esm2	None known
`tomcat8` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 8.0.26-18.0.28-18.0.30-18.0.32-18.0.32-1ubuntu1 Show 14 moreShow less 8.0.32-1ubuntu1.18.0.32-1ubuntu1.28.0.32-1ubuntu1.38.0.32-1ubuntu1.48.0.32-1ubuntu1.58.0.32-1ubuntu1.68.0.32-1ubuntu1.78.0.32-1ubuntu1.88.0.32-1ubuntu1.98.0.32-1ubuntu1.108.0.32-1ubuntu1.118.0.32-1ubuntu1.138.0.32-1ubuntu1.13+esm18.0.32-1ubuntu1.13+esm2	None known
`tomcat7` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 7.0.64-17.0.68-17.0.68-1ubuntu0.17.0.68-1ubuntu0.37.0.68-1ubuntu0.4 Show 4 moreShow less 7.0.68-1ubuntu0.4+esm17.0.68-1ubuntu0.4+esm27.0.68-1ubuntu0.4+esm37.0.68-1ubuntu0.4+esm4	None known
`tomcat8` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 8.5.21-1ubuntu18.5.29-18.5.30-18.5.30-1ubuntu18.5.30-1ubuntu1.2 Show 11 moreShow less 8.5.30-1ubuntu1.38.5.30-1ubuntu1.48.5.39-1ubuntu1~18.04.18.5.39-1ubuntu1~18.04.28.5.39-1ubuntu1~18.04.38.5.39-1ubuntu1~18.04.3+esm18.5.39-1ubuntu1~18.04.3+esm28.5.39-1ubuntu1~18.04.3+esm38.5.39-1ubuntu1~18.04.3+esm48.5.39-1ubuntu1~18.04.3+esm58.5.39-1ubuntu1~18.04.3+esm6	None known
`tomcat9` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 9.0.16-3~18.04.19.0.16-3ubuntu0.18.04.19.0.16-3ubuntu0.18.04.29.0.16-3ubuntu0.18.04.2+esm19.0.16-3ubuntu0.18.04.2+esm2 Show 6 moreShow less 9.0.16-3ubuntu0.18.04.2+esm39.0.16-3ubuntu0.18.04.2+esm49.0.16-3ubuntu0.18.04.2+esm59.0.16-3ubuntu0.18.04.2+esm69.0.16-3ubuntu0.18.04.2+esm79.0.16-3ubuntu0.18.04.2+esm8	None known
`tomcat9` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 9.0.24-19.0.27-19.0.31-19.0.31-1ubuntu0.19.0.31-1ubuntu0.2 Show 10 moreShow less 9.0.31-1ubuntu0.39.0.31-1ubuntu0.49.0.31-1ubuntu0.59.0.31-1ubuntu0.69.0.31-1ubuntu0.79.0.31-1ubuntu0.89.0.31-1ubuntu0.99.0.31-1ubuntu0.9+esm19.0.31-1ubuntu0.9+esm29.0.31-1ubuntu0.9+esm3	None known
`tomcat9` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 9.0.43-39.0.54-19.0.55-19.0.58-19.0.58-1ubuntu0.1 Show 9 moreShow less 9.0.58-1ubuntu0.1+esm19.0.58-1ubuntu0.1+esm29.0.58-1ubuntu0.1+esm39.0.58-1ubuntu0.1+esm49.0.58-1ubuntu0.29.0.58-1ubuntu0.2+esm19.0.58-1ubuntu0.2+esm29.0.58-1ubuntu0.2+esm39.0.58-1ubuntu0.2+esm4	None known
`tomcat10` Ubuntu:24.04:LTS	All versions, plus listed versions 10.1.10-110.1.14-110.1.15-110.1.16-110.1.16-1ubuntu0.1~esm1 Show 4 moreShow less 10.1.16-1ubuntu0.1~esm210.1.16-1ubuntu0.1~esm310.1.16-1ubuntu0.1~esm410.1.55-1ubuntu2~24.04.1	None known
`tomcat9` Ubuntu:24.04:LTS	All versions, plus listed versions 9.0.70-1ubuntu19.0.70-29.0.70-2ubuntu0.19.0.70-2ubuntu0.1+esm19.0.70-2ubuntu0.1+esm29.0.70-2ubuntu0.1+esm39.0.118-1~24.04.1	None known
`tomcat10` Ubuntu:25.10	All versions, plus listed versions 10.1.35-110.1.40-110.1.40-1ubuntu110.1.40-1ubuntu1.25.10.1	None known
`tomcat11` Ubuntu:25.10	All versions, plus listed versions 11.0.6-1	None known
`tomcat9` Ubuntu:25.10	All versions, plus listed versions 9.0.70-2ubuntu1.19.0.70-2ubuntu29.0.70-2ubuntu39.0.95-1ubuntu19.0.95-1ubuntu1.1	None known
`tomcat10` Ubuntu:26.04:LTS	All versions, plus listed versions 10.1.40-1ubuntu110.1.40-1ubuntu1.26.04.110.1.55-1ubuntu2~26.04.1	None known
`tomcat9` Ubuntu:26.04:LTS	All versions, plus listed versions 9.0.95-1ubuntu19.0.111-19.0.115-19.0.115-1ubuntu0.19.0.118-1~26.04.1	None known
`tomcat11` Ubuntu:26.04:LTS	All versions, plus listed versions 11.0.6-111.0.11-111.0.15-111.0.18-111.0.18-1ubuntu0.1~esm111.0.22-2ubuntu2~26.04.1	None known
`tomcat` openSUSE:Tumbleweed	before 9.0.117-1.1	9.0.117-1.1
`tomcat10` openSUSE:Tumbleweed	before 10.1.54-1.1	10.1.54-1.1
`tomcat11` openSUSE:Tumbleweed	before 11.0.21-1.1	11.0.21-1.1
`tomcat11` openSUSE:Leap 16.0	before 11.0.21-160000.1.1	11.0.21-160000.1.1
`tomcat` openSUSE:Leap 16.0	before 9.0.117-160000.1.1	9.0.117-160000.1.1
`tomcat10` openSUSE:Leap 16.0	before 10.1.54-160000.1.1	10.1.54-160000.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	xiaoqiMikko/tomcat-line-check	2026-09-01

History

History
Recorded	Changed	Sources
Nov 4, 2026	affected, aliases, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-24880 is a high vulnerability (CVSS 7.5) in Apache Tomcat, published April 9, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in org.apache.tomcat:tomcat-coyote 9.0.116.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 552 versions, 108 references and the rest of 1 source description. The JSON record has them.