{"id":"CLSA-2026-1779465287","aliases":[],"status":"published","title":"tomcat: Fix of 12 CVEs","description":"- Bump leading release to maintain monotonic rpm-version ordering\n  in the AlmaLinux 9.2 ESU update stream","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-06-03T08:15:39Z","modified":"2026-10-26T09:30:05Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat","fixed_in":["1:9.0.62-12.el9_2.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-admin-webapps","fixed_in":["1:9.0.62-12.el9_2.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-docs-webapp","fixed_in":["1:9.0.62-12.el9_2.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-el-3.0-api","fixed_in":["1:9.0.62-12.el9_2.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-jsp-2.3-api","fixed_in":["1:9.0.62-12.el9_2.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-lib","fixed_in":["1:9.0.62-12.el9_2.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-servlet-4.0-api","fixed_in":["1:9.0.62-12.el9_2.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-webapps","fixed_in":["1:9.0.62-12.el9_2.1.tuxcare.els1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els1"}]}]}],"references":[{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779465287.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34305","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48976","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52520","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53506","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24733","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41293","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42498","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43512","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43513","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43514","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43515","tags":["advisory"]}],"sources":{"osv":[{"id":"CLSA-2026-1779465287","title":"tomcat: Fix of 12 CVEs","description":"- Bump leading release to maintain monotonic rpm-version ordering\n  in the AlmaLinux 9.2 ESU update stream","status":"published","published":"2026-06-03T08:15:39Z","modified":"2026-10-26T09:30:05.654209946Z","updated_at":"2026-11-02T15:43:45.090939Z"}]}}