Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014270 advisory.

    Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

    When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not     complete verification or freshness checks on the OCSP response which could allow certificate revocation to     be bypassed.

    This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache     Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.


    The following versions were EOL at the time the CVE was created but are     known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39.Older EOL versions are not     affected.

    Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which     fix the issue.

    Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115     or later which fix the issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.3.1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.3.1.7 advisory.

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the     png_set_quantize() API function. When the function is called with no histogram and the number of colors in     the palette is more than twice the maximum supported by the user's display, certain palettes will cause     the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer.
    The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is     fixed in 1.6.55. (CVE-2026-25646)

  - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP     responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification     or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This     issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat:
    from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following     versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through     1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are     recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat     users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which     fix the issue. (CVE-2026-24734)

  - Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a     BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before     the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have     various consequences including a Denial of Service. The OPENSSL_uni2utf8() function performs a two-pass     conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the     helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the     destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes,     but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is     added to the output length without validation, causing the length to become negative. The subsequent     trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer.
    The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-     controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue,     PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to     provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one     zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity     according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this     issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4,     3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.
    (CVE-2025-69419)

  - Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow     vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The     vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim     copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes     (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been     patched in version 9.1.2132. (CVE-2026-25749)

  - A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a     programming error where the gettext command remains registered in memory after its module is unloaded. An     attacker can exploit this condition by invoking the orphaned command, causing the application to access a     memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to     crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not     discarded. (CVE-2025-61662)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20444-1 advisory.

    Update to Tomcat 10.1.52:

    - CVE-2025-55752: directory traversal via rewrite with possible RCE if PUT is enabled (bsc#1252753).
    - CVE-2025-55754: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache     Tomcat       (bsc#1252905).
    - CVE-2025-61795: temporary copies during the processing of multipart upload can lead to a denial of     service       (bsc#1252756).
    - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
    - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
    - CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).

    Changelog:

     - Fix: 69623: Additional fix for the long standing regression that meant      that calls to ClassLoader.getResource().getContent() failed when made from      within a web application with resource caching enabled if the target      resource was packaged in a JAR file. (markt)      + Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the      CsrfPreventionFilter. (schultz)      + Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2      requests when the content-length header is not set. (dsoumis)      + Update: Enable minimum and recommended Tomcat Native versions to be set      separately for Tomcat Native 1.x and 2.x. Update the minimum and      recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum      and recommended versions for Tomcat Native 2.x to 2.0.12. (markt)      + Add: Add a new ssoReauthenticationMode to the Tomcat provided      Authenticators that provides a per Authenticator override of the SSO Valve      requireReauthentication attribute. (markt)      + Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception      rather than silently using a replacement character. (markt)      + Fix: 69932: Fix request end access log pattern regression, which would log      the start time of the request instead. (remm)      + Fix: 69871: Increase log level to INFO for missing configuration for the      rewrite valve. (remm)      + Fix: Add log warnings for additional Host appBase suspicious values.
     (remm)      + Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
     org.apache.catalina.Connector no longer requires      org.apache.tomcat.jni.AprStatus to be present. (markt)      + Add: Add the ability to use a custom function to generate the client      identifier in the CrawlerSessionManagerValve. This is only available      programmatically. Pull request #902 by Brian Matzon. (markt)      + Fix: Change the SSO reauthentication behaviour for SPNEGO authentication      so that a normal SPNEGO authentication is performed if the SSL Valve is      configured with reauthentication enabled. This is so that the delegated      credentials will be available to the web application. (markt)      + Fix: When generating the class path in the Loader, re-order the check on      individual class path components to avoid a potential      NullPointerException. Identified by Coverity Scan. (markt)      + Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull      request #915 by Joshua Rogers. (remm)      + Update: Add an attribute, digestInRfc3112Order, to      MessageDigestCredentialHandler to control the order in which the      credential and salt are digested. By default, the current, non-RFC 3112      compliant, order of salt then credential will be used. This default will      change in Tomcat 12 to the RFC 3112 compliant order of credential then      salt. (markt)      + Fix: Log warnings when the SSO configuration does not comply with the      documentation. (remm)      + Update: Deprecate the RemoteAddrFilter and RemoteAddrValve in favour of      the RemoteCIDRFilter and RemoteCIDRValve. (markt)      + Fix: 69837: Fix corruption of the class path generated by the Loader when      running on Windows. (markt)      + Fix: Reject requests that map to invalid Windows file names earlier.
     (markt)      + Fix: 69839: Ensure that changes to session IDs (typically after      authentication) are promulgated to the SSO Valve to ensure that SSO      entries are fully clean-up on session expiration. Patch provided by Kim      Johan Andersson. (markt)      + Fix: Fix a race condition in the creation of the storage location for the      FileStore. (markt)
     * Cluster      + Add: 62814: Document that human-readable names may be used for      mapSendOptions and align documentation with channelSendOptions. Based on      pull request #929 by archan0621. (markt)
     * Clustering      + Fix: Correct a regression introduced in 10.1.45 that broke some clustering      configurations. (markt)
     * Coyote      + Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown      that triggered a significant memory leak. Patch provided by Wes. (markt)      + Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm)      + Fix: Improve warnings when setting ciphers lists in the FFM code,      mirroring the tomcat-native changes. (remm)      + Fix: 69910: Dereference TLS objects right after closing a socket to      improve memory efficiency. (remm)      + Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig      to reflect the existing implementation that allows one configuration style      to be used for the trust attributes and a different style for all the      other attributes. (markt)      + Fix: Better warning message when OpenSSLConf configuration elements are      used with a JSSE TLS implementation. (markt)      + Fix: When using OpenSSL via FFM, don't log a warning about missing CA      certificates unless CA certificates were configured and the configuration      failed. (markt)      + Add: For configuration consistency between OpenSSL and JSSE TLS      implementations, TLSv1.3 cipher suites included in the ciphers attribute      of an SSLHostConfig are now always ignored (previously they would be      ignored with OpenSSL implementations and used with JSSE implementations)      and a warning is logged that the cipher suite has been ignored. (markt)      + Add: Add the ciphersuite attribute to SSLHostConfig to configure the      TLSv1.3 cipher suites. (markt)      + Add: Add OCSP support to JSSE based TLS connectors and make the use of      OCSP configurable per connector for both JSSE and OpenSSL based TLS      implementations. Align the checks performed by OpenSSL with those      performed by JSSE. (markt)      + Add: Add support for soft failure of OCSP checks with soft failure support      disabled by default. (markt)      + Add: Add support for configuring the verification flags passed to      OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)      + Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
     + Fix: Prevent concurrent release of OpenSSLEngine resources and the      termination of the Tomcat Native library as it can cause crashes during      Tomcat shutdown. (markt)      + Fix: Don't log an incorrect certificate KeyStore location when creating a      TLS connector if the KeyStore instance has been set directly on the      connector. (markt)      + Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)      + Add: Add strictSni attribute on the Connector to allow matching the      SSLHostConfig configuration associated with the SNI host name to the      SSLHostConfig configuration matched from the HTTP protocol host name. Non      matching configurations will cause the request to be rejected. The      attribute default value is true, enabling the matching. (remm)      + Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)      + Fix: Fix use of deferAccept attribute in JMX, since it is normally only      removed in Tomcat 11. (remm)      + Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL      provider. Pull request #912 by aogburn. (markt)      + Fix: Fix potential crash on shutdown when a Connector depends on the      Tomcat Native library. (markt)      + Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
     + Fix: 69848: Fix copy/paste errors in 10.1.47 that meant DELETE requests      received via the AJP connector were processed as OPTIONS requests and      PROPFIND requests were processed as TRACE. (markt)      + Fix: Various OCSP processing issues in the OpenSSL FFM code. (dsoumis)
     * General      + Add: Add test.silent property to suppress JUnit console output during test      execution. Useful for cleaner console output when running tests with      multiple threads. (csutherl)
     * Jasper      + Fix: 69333: Correct a regression in the previous fix for 69333 and ensure      that reuse() or release() is always called for a tag. (markt)      + Fix: 69877: Catch IllegalArgumentException when processing URIs when      creating the classpath to handle invalid URIs. (remm)      + Fix: Fix populating the classpath with the webapp classloader      repositories. (remm)      + Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some      exception details. Patch submitted by Eric Blanquer. (remm)
     * Jdbc-pool      + Fix: 64083: If the underlying connection has been closed, don't add it to      the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
     * Web applications      + Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server      status output if one or more of the web applications failed to start.
     (schultz)      + Add: Manager: Include web application state in the HTML and JSON complete      server status output. (markt)      + Add: Documentation: Expand the documentation to better explain when OCSP      is supported and when it is not. (markt)
     * Websocket      + Fix: 69920: When attempting to write to a closed Writer or OutputStream      obtained from a WebSocket session, throw an IOException rather than an      IllegalStateExcpetion as required by Writer and strongly suggested by      OutputStream. (markt)      + Fix: 69845: When using permessage-deflate with Java 25 onwards, handle the      underlying Inflater and/or Deflater throwing IllegalStateException when      closed rather than NullPointerException as they do in Java 24 and earlier.
     * Other      + Update: Update the internal fork of Commons Pool to 2.13.1. (markt)      + Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)      + Update: Update Commons Daemon to 1.5.1. (markt)      + Update: Update ByteBuddy to 1.18.3. (markt)      + Update: Update UnboundID to 7.0.4. (markt)      + Update: Update Checkstyle to 12.3.1. (markt)      + Add: Improvements to French translations. (markt)      + Add: Improvements to Japanese translations provided by tak7iji. (markt)      + Add: Improvements to Chinese translations provided by Yang. vincent.h and      yong hu. (markt)      + Update: Update Tomcat Native to 2.0.12. (markt)      + Add: Add property gpg.sign.files to optionally disable release artefact      signing with GPG. (rjung)      + Add: Add test profile system for selective test execution. Profiles can be      specified via -Dtest.profile=<name> to run specific test subsets without      using patterns directly. Profile patterns are defined in      test-profiles.properties. (csutherl)      + Update: Update file extension to media type mappings to align with the      current list used by the Apache Web Server (httpd). (markt)      + Update: Update the packaged version of the Tomcat Migration Tool for      Jakarta EE to 1.0.10. (markt)      + Update: Update Commons Daemon to 1.5.0. (markt)      + Update: Update Byte Buddy to 1.18.2. (markt)      + Update: Update Checkstyle to 12.2.0. (markt)      + Add: Improvements to Spanish translations provided by White Vogel. (markt)      + Add: Improvements to French translations. (remm)      + Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)      + Update: Update to Byte Buddy 1.17.8. (markt)      + Update: Update to Checkstyle 12.1.1. (markt)      + Update: Update to Jacoco 0.8.14. (markt)      + Update: Update to SpotBugs 4.9.8. (markt)      + Update: Update to JSign 7.4. (markt)      + Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)

    Update to Tomcat 10.1.48:

     - Update: Deprecate the RemoteAddrFilter and RemoteAddValve in favour of the      RemoteCIDRFilter and RemoteCIDRValve. (markt)      + Fix: HTTP methods are case-sensitive so always use case sensitive      comparisons when comparing HTTP methods. (markt)      + Fix: 69814: Ensure that HttpSession.isNew() returns false once the client      has joined the session. (markt)      + Fix: Further performance improvements for ParameterMap. (jengebr/markt)      + Code: Refactor access log time stamps to be based on the Instant request      processing starts. (markt)      + Fix: Fix a case-sensitivity issue in the trailer header allow list.
     + Fix: Be proactive in cleaning up temporary files after a failed multi-part      upload rather than waiting for GC to do it. (markt)      + Update: Change the digest used to calculate strong ETags (if enabled) for      the default Servlet from SHA-1 to SHA-256 to align with the recommendation      in RFC 9110 that hash functions used to generate strong ETags should be      collision resistant. (markt)      + Fix: Correct a regression in the fix for 69781 that broke FileStore.
     + Code: Remove a number of unnecessary packages from the      catalina-deployer.jar. (markt)      + Fix: 69781: Fix concurrent access issues in the session FileStore      implementation that were causing lost sessions when the store was used      with the PersistentValve. Based on pull request #882 by Aaron Ogburn.
     + Fix: Fix handling of QSA and QSD flags in RewriteValve. (markt)      + Fix: Prevent the channel configuration (sender, receiver, membership      service) from being changed unless the channel is fully stopped. (markt)      + Fix: Handle spurious wake-ups during leader election for      NonBlockingCoordinator. (markt)      + Fix: Handle spurious wake-ups during sending of messages by RpcChannel.
     + Update: Add specific certificate selection code for TLS 1.3 supporting      post quantum cryptography. Certificates defined with type MLDSA will be      selected depending on the TLS client hello. (remm)      + Update: Add groups attribute on SSLHostConfig allowing to restrict which      groups can be enabled on the SSL engine. (remm)      + Add: Optimize the conversion of HTTP method from byte form to String form.
     + Fix: Store HTTP request headers using the original case for the header      name rather than forcing it to lower case. (markt)      + Update: Add hybrid PQC support to OpenSSL, based on code from mod_ssl.
     Using this OpenSSL specific code path, additional PQC certificates defined      with type MLDSA are added to contexts which use classic certificates.
     (jfclere/remm)      + Fix: Ensure keys are handed out to OpenSSL even if PEMFile fails to      process it, with appropriate logging. (remm)      + Fix: Add new ML-DSA key algorithm to PEMFile and improve reporting when      reading a key fails. (remm)      + Fix: Fix possible early timeouts for network operations caused by a      spurious wake-up of a waiting thread. Found by Coverity Scan. (markt)      + Fix: Documentation. Clarify the purpose of the maxPostSize attribute of      the Connector element. (markt)      + Fix: Avoid NPE in manager webapp displaying certificate information.
     + Update: Update Byte Buddy to 1.17.7. (markt)      + Update: Update Checkstyle to 11.1.0. (markt)      + Update: Update SpotBugs to 4.9.6. (markt)      + Update: Update Jsign to 7.2. (markt)      + Add: Improvements to Russian translations provided by usmazat. (markt)      + Update: Minor refactoring in JULI loggers. Patch provided by minjund.
     + Code: Review logging and include the full stack trace and exception      message by default rather then just the exception message when logging an      error or warning in response to an exception. (markt)      + Add: Add escaping to log formatters to align with JSON formatter. (markt)      + Update: Update Checkstyle to 11.0.0. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1497 advisory.

    mproper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14,     from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time     the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not     affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the     host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host     and the TLS configuration for one of those hosts did not require client certificate authentication but     another one did, it was possible for a client to bypass the client certificate authentication by sending     different host names in the SNI extension and the HTTP host header field. The vulnerability only applies     if client certificate authentication is only enforced at the Connector. It does not apply if client     certificate authentication is enforced at the web application. Users are recommended to upgrade to version     11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue. (CVE-2025-66614)

    A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass     security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a     URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0.9 protocol     can bypass the intended denial rule, enabling an attacker to access resources that should be protected.
    (CVE-2026-24733)

    Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

    When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not     complete verification or freshness checks on the OCSP response which could allow certificate revocation to     be bypassed.

    This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache     Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.

    The following versions were EOL at the time the CVE was created but areknown to be affected: from 1.1.23     through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

    Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which     fix the issue.

    Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115     or later which fix the issue. (CVE-2026-24734)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1496 advisory.

    mproper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14,     from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time     the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not     affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the     host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host     and the TLS configuration for one of those hosts did not require client certificate authentication but     another one did, it was possible for a client to bypass the client certificate authentication by sending     different host names in the SNI extension and the HTTP host header field. The vulnerability only applies     if client certificate authentication is only enforced at the Connector. It does not apply if client     certificate authentication is enforced at the web application. Users are recommended to upgrade to version     11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue. (CVE-2025-66614)

    A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass     security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a     URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0.9 protocol     can bypass the intended denial rule, enabling an attacker to access resources that should be protected.
    (CVE-2026-24733)

    Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

    When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not     complete verification or freshness checks on the OCSP response which could allow certificate revocation to     be bypassed.

    This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache     Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.

    The following versions were EOL at the time the CVE was created but areknown to be affected: from 1.1.23     through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

    Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which     fix the issue.

    Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115     or later which fix the issue. (CVE-2026-24734)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20414-1 advisory.

    Update to Tomcat 11.0.18:

    - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
    - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
    - CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).

    Changelog:

     - Fix: 69932: Fix request end access log pattern regression, which would log      the start time of the request instead. (remm)      + Fix: 69623: Additional fix for the long standing regression that meant      that calls to ClassLoader.getResource().getContent() failed when made from      within a web application with resource caching enabled if the target      resource was packaged in a JAR file. (markt)      + Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the      CsrfPreventionFilter. (schultz)      + Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2      requests when the content-length header is not set. (dsoumis)      + Update: Enable minimum and recommended Tomcat Native versions to be set      separately for Tomcat Native 1.x and 2.x. Update the minimum and      recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum      and recommended versions for Tomcat Native 2.x to 2.0.12. (markt)      + Add: Add a new ssoReauthenticationMode to the Tomcat provided      Authenticators that provides a per Authenticator override of the SSO Valve      requireReauthentication attribute. (markt)      + Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception      rather than silently using a replacement character. (markt)      + Fix: 69871: Increase log level to INFO for missing configuration for the      rewrite valve. (remm)      + Fix: Add log warnings for additional Host appBase suspicious values.
     (remm)      + Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
     org.apache.catalina.Connector no longer requires      org.apache.tomcat.jni.AprStatus to be present. (markt)      + Add: Add the ability to use a custom function to generate the client      identifier in the CrawlerSessionManagerValve. This is only available      programmatically. Pull request #902 by Brian Matzon. (markt)      + Fix: Change the SSO reauthentication behaviour for SPNEGO authentication      so that a normal SPNEGO authentication is performed if the SSL Valve is      configured with reauthentication enabled. This is so that the delegated      credentials will be available to the web application. (markt)      + Fix: When generating the class path in the Loader, re-order the check on      individual class path components to avoid a potential      NullPointerException. Identified by Coverity Scan. (markt)      + Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull      request #915 by Joshua Rogers. (remm)      + Update: Add an attribute, digestInRfc3112Order, to      MessageDigestCredentialHandler to control the order in which the      credential and salt are digested. By default, the current, non-RFC 3112      compliant, order of salt then credential will be used. This default will      change in Tomcat 12 to the RFC 3112 compliant order of credential then      salt. (markt)
     * Cluster      + Add: 62814: Document that human-readable names may be used for      mapSendOptions and align documentation with channelSendOptions. Based on      pull request #929 by archan0621. (markt)
     * Clustering      + Fix: Correct a regression introduced in 11.0.11 that broke some clustering      configurations. (markt)
     * Coyote      + Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown      that triggered a significant memory leak. Patch provided by Wes. (markt)      + Fix: Prevent concurrent release of OpenSSLEngine resources and the      termination of the Tomcat Native library as it can cause crashes during      Tomcat shutdown. (markt)      + Fix: Improve warnings when setting ciphers lists in the FFM code,      mirroring the tomcat-native changes. (remm)      + Fix: 69910: Dereference TLS objects right after closing a socket to      improve memory efficiency. (remm)      + Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig      to reflect the existing implementation that allows one configuration style      to be used for the trust attributes and a different style for all the      other attributes. (markt)      + Fix: Better warning message when OpenSSLConf configuration elements are      used with a JSSE TLS implementation. (markt)      + Fix: When using OpenSSL via FFM, don't log a warning about missing CA      certificates unless CA certificates were configured and the configuration      failed. (markt)      + Add: For configuration consistency between OpenSSL and JSSE TLS      implementations, TLSv1.3 cipher suites included in the ciphers attribute      of an SSLHostConfig are now always ignored (previously they would be      ignored with OpenSSL implementations and used with JSSE implementations)      and a warning is logged that the cipher suite has been ignored. (markt)      + Add: Add the ciphersuite attribute to SSLHostConfig to configure the      TLSv1.3 cipher suites. (markt)      + Add: Add OCSP support to JSSE based TLS connectors and make the use of      OCSP configurable per connector for both JSSE and OpenSSL based TLS      implementations. Align the checks performed by OpenSSL with those      performed by JSSE. (markt)      + Add: Add support for soft failure of OCSP checks with soft failure support      disabled by default. (markt)      + Add: Add support for configuring the verification flags passed to      OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)      + Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
     + Fix: Don't log an incorrect certificate KeyStore location when creating a      TLS connector if the KeyStore instance has been set directly on the      connector. (markt)      + Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)      + Add: Add strictSni attribute on the Connector to allow matching the      SSLHostConfig configuration associated with the SNI host name to the      SSLHostConfig configuration matched from the HTTP protocol host name. Non      matching configurations will cause the request to be rejected. The      attribute default value is true, enabling the matching. (remm)      + Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)      + Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL      provider. Pull request #912 by aogburn. (markt)      + Fix: Fix potential crash on shutdown when a Connector depends on the      Tomcat Native library. (markt)      + Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
     * Jasper      + Fix: 69333: Correct a regression in the previous fix for 69333 and ensure      that reuse() or release() is always called for a tag. (markt)      + Fix: 69877: Catch IllegalArgumentException when processing URIs when      creating the classpath to handle invalid URIs. (remm)      + Fix: Fix populating the classpath with the webapp classloader      repositories. (remm)      + Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some      exception details. Patch submitted by Eric Blanquer. (remm)
     * Jdbc-pool      + Fix: 64083: If the underlying connection has been closed, don't add it to      the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
     * Web applications      + Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server      status output if one or more of the web applications failed to start.
     (schultz)      + Add: Manager: Include web application state in the HTML and JSON complete      server status output. (markt)      + Add: Documentation: Expand the documentation to better explain when OCSP      is supported and when it is not. (markt)
     * Websocket      + Fix: 69920: When attempting to write to a closed Writer or OutputStream      obtained from a WebSocket session, throw an IOException rather than an      IllegalStateExcpetion as required by Writer and strongly suggested by      OutputStream. (markt)
     * Other      + Add: Add property gpg.sign.files to optionally disable release artefact      signing with GPG. (rjung)      + Add: Add test.silent property to suppress JUnit console output during test      execution. Useful for cleaner console output when running tests with      multiple threads. (csutherl)      + Update: Update the internal fork of Commons Pool to 2.13.1. (markt)      + Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)      + Update: Update Commons Daemon to 1.5.1. (markt)      + Update: Update to the Eclipse JDT compiler 4.37. (markt)      + Update: Update ByteBuddy to 1.18.3. (markt)      + Update: Update UnboundID to 7.0.4. (markt)      + Update: Update Checkstyle to 12.3.1. (markt)      + Add: Improvements to French translations. (markt)      + Add: Improvements to Japanese translations provided by tak7iji. (markt)      + Add: Improvements to Chinese translations provided by Yang. vincent.h and      yong hu. (markt)      + Update: Update Tomcat Native to 2.0.12. (markt)      + Add: Add test profile system for selective test execution. Profiles can be      specified via -Dtest.profile=<name> to run specific test subsets without      using patterns directly. Profile patterns are defined in      test-profiles.properties. (csutherl)      + Update: Update file extension to media type mappings to align with the      current list used by the Apache Web Server (httpd). (markt)      + Update: Update the packaged version of the Tomcat Migration Tool for      Jakarta EE to 1.0.10. (markt)      + Update: Update Commons Daemon to 1.5.0. (markt)      + Update: Update Byte Buddy to 1.18.2. (markt)      + Update: Update Checkstyle to 12.2.0. (markt)      + Add: Improvements to Spanish translations provided by White Vogel. (markt)      + Add: Improvements to French translations. (remm)      + Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)      + Update: Update to Byte Buddy 1.17.8. (markt)      + Update: Update to Checkstyle 12.1.1. (markt)      + Update: Update to Jacoco 0.8.14. (markt)      + Update: Update to SpotBugs 4.9.8. (markt)      + Update: Update to JSign 7.4. (markt)      + Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:5611 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web     applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster),     the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

    This release of Red Hat JBoss Web Server 6.2.1 serves as a replacement for Red Hat JBoss Web Server 6.2.0.
    This release includes bug fixes, enhancements and component upgrades, which are documented in the Release     Notes that are linked to in the References section.

    Security Fix(es):

    * tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation     (CVE-2026-24734)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0932-1 advisory.

    Update to Tomcat 9.0.115:

    - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
    - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
    - CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).

    Changelog:

     * Catalina      + Fix: 69623: Additional fix for the long standing regression that meant      that calls to ClassLoader.getResource().getContent() failed when made from      within a web application with resource caching enabled if the target      resource was packaged in a JAR file. (markt)      + Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the      CsrfPreventionFilter. (schultz)      + Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2      requests when the content-length header is not set. (dsoumis)      + Update: Update the minimum and recommended versions for Tomcat Native to      1.3.4. (markt)      + Add: Add a new ssoReauthenticationMode to the Tomcat provided      Authenticators that provides a per Authenticator override of the SSO Valve      requireReauthentication attribute. (markt)      + Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception      rather than silently using a replacement character. (markt)      + Fix: 69871: Increase log level to INFO for missing configuration for the      rewrite valve. (remm)      + Fix: Add log warnings for additional Host appBase suspicious values.
     (remm)      + Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
     org.apache.catalina.Connector no longer requires      org.apache.tomcat.jni.AprStatus to be present. (markt)      + Add: Add the ability to use a custom function to generate the client      identifier in the CrawlerSessionManagerValve. This is only available      programmatically. Pull request #902 by Brian Matzon. (markt)      + Fix: Change the SSO reauthentication behaviour for SPNEGO authentication      so that a normal SPNEGO authentication is performed if the SSL Valve is      configured with reauthentication enabled. This is so that the delegated      credentials will be available to the web application. (markt)      + Fix: When generating the class path in the Loader, re-order the check on      individual class path components to avoid a potential      NullPointerException. Identified by Coverity Scan. (markt)      + Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull      request #915 by Joshua Rogers. (remm)      + Update: Add an attribute, digestInRfc3112Order, to      MessageDigestCredentialHandler to control the order in which the      credential and salt are digested. By default, the current, non-RFC 3112      compliant, order of salt then credential will be used. This default will      change in Tomcat 12 to the RFC 3112 compliant order of credential then      salt. (markt)
     * Cluster      + Add: 62814: Document that human-readable names maybe used for      mapSendOptions and align documentation with channelSendOptions. Based on      pull request #929 by archan0621. (markt)
     * Clustering      + Fix: Correct a regression introduced in 9.0.109 that broke some clustering      configurations. (markt)
     * Coyote      + Fix: Prevent concurrent release of OpenSSLEngine resources and the      termination of the Tomcat Native library as it can cause crashes during      Tomcat shutdown. (markt)      + Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm)      + Fix: Improve warnings when setting ciphers lists in the FFM code,      mirroring the tomcat-native changes. (remm)      + Fix: 69910: Dereference TLS objects right after closing a socket to      improve memory efficiency. (remm)      + Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig      to reflect the existing implementation that allows one configuration style      to be used for the trust attributes and a different style for all the      other attributes. (markt)      + Fix: Better warning message when OpenSSLConf configuration elements are      used with a JSSE TLS implementation. (markt)      + Fix: When using OpenSSL via FFM, don't log a warning about missing CA      certificates unless CA certificates were configured and the configuration      failed. (markt)      + Add: For configuration consistency between OpenSSL and JSSE TLS      implementations, TLSv1.3 cipher suites included in the ciphers attribute      of an SSLHostConfig are now always ignored (previously they would be      ignored with OpenSSL implementations and used with JSSE implementations)      and a warning is logged that the cipher suite has been ignored. (markt)      + Add: Add the ciphersuite attribute to SSLHostConfig to configure the      TLSv1.3 cipher suites. (markt)      + Add: Add OCSP support to JSSE based TLS connectors and make the use of      OCSP configurable per connector for both JSSE and OpenSSL based TLS      implementations. Align the checks performed by OpenSSL with those      performed by JSSE. (markt)      + Add: Add support for soft failure of OCSP checks with soft failure support      disabled by default. (markt)      + Add: Add support for configuring the verification flags passed to      OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)      + Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
     + Fix: Don't log an incorrect certificate KeyStore location when creating a      TLS connector if the KeyStore instance has been set directly on the      connector. (markt)      + Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)      + Add: Add strictSni attribute on the Connector to allow matching the      SSLHostConfig configuration associated with the SNI host name to the      SSLHostConfig configuration matched from the HTTP protocol host name. Non      matching configurations will cause the request to be rejected. The      attribute default value is true, enabling the matching. (remm)      + Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)      + Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL      provider. Pull request #912 by aogburn. (markt)      + Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
     * Jasper      + Fix: 69333: Correct a regression in the previous fix for 69333 and ensure      that reuse() or release() is always called for a tag. (markt)      + Fix: 69877: Catch IllegalArgumentException when processing URIs when      creating the classpath to handle invalid URIs. (remm)      + Fix: Fix populating the classpath with the webapp classloader      repositories. (remm)      + Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some      exception details. Patch submitted by Eric Blanquer. (remm)
     * Jdbc-pool      + Fix: 64083: If the underlying connection has been closed, don't add it to      the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
     * Web applications      + Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server      status output if one or more of the web applications failed to start.
     (schultz)      + Add: Manager: Include web application state in the HTML and JSON complete      server status output. (markt)      + Add: Documentation: Expand the documentation to better explain when OCSP      is supported and when it is not. (markt)
     * Websocket      + Fix: 69920: When attempting to write to a closed Writer or OutputStream      obtained from a WebSocket session, throw an IOException rather than an      IllegalStateExcpetion as required by Writer and strongly suggested by      OutputStream. (markt)
     * Other      + Add: Add property 'gpg.sign.files' to optionally disable release artefact      signing with GPG. (rjung)      + Add: Add test.silent property to suppress JUnit console output during test      execution. Useful for cleaner console output when running tests with      multiple threads. (csutherl)      + Update: Update the internal fork of Commons Pool to 2.13.1. (markt)      + Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)      + Update: Update Commons Daemon to 1.5.1. (markt)      + Update: Update ByteBuddy to 1.18.3. (markt)      + Update: Update UnboundID to 7.0.4. (markt)      + Update: Update Checkstyle to 12.3.1. (markt)      + Add: Improvements to French translations. (markt)      + Add: Improvements to Japanese translations provided by tak7iji. (markt)      + Add: Improvements to Chinese translations provided by Yang. vincent.h and      yong hu. (markt)      + Update: Update Tomcat Native to 1.3.5. (markt)      + Add: Add test profile system for selective test execution. Profiles can be      specified via -Dtest.profile=<name> to run specific test subsets without      using patterns directly. Profile patterns are defined in      test-profiles.properties. (csutherl)      + Update: Update file extension to media type mappings to align with the      current list used by the Apache Web Server (httpd). (markt)      + Update: Update Commons Daemon to 1.5.0. (markt)      + Update: Update Byte Buddy to 1.18.2. (markt)      + Update: Update Checkstyle to 12.2.0. (markt)      + Add: Improvements to Spanish translations provided by White Vogel. (markt)      + Add: Improvements to French translations. (remm)      + Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)      + Update: Update to Byte Buddy 1.17.8. (markt)      + Update: Update to Checkstyle 12.1.1. (markt)      + Update: Update to Jacoco 0.8.14. (markt)      + Update: Update to SpotBugs 4.9.8. (markt)      + Update: Update to JSign 7.4. (markt)      + Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tomcat installed on the remote host is prior to 9.0.115-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2026-024 advisory.

    mproper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14,     from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time     the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not     affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the     host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host     and the TLS configuration for one of those hosts did not require client certificate authentication but     another one did, it was possible for a client to bypass the client certificate authentication by sending     different host names in the SNI extension and the HTTP host header field. The vulnerability only applies     if client certificate authentication is only enforced at the Connector. It does not apply if client     certificate authentication is enforced at the web application. Users are recommended to upgrade to version     11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue. (CVE-2025-66614)

    A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass     security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a     URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0.9 protocol     can bypass the intended denial rule, enabling an attacker to access resources that should be protected.
    (CVE-2026-24733)

    Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

    When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not     complete verification or freshness checks on the OCSP response which could allow certificate revocation to     be bypassed.

    This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache     Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.

    The following versions were EOL at the time the CVE was created but areknown to be affected: from 1.1.23     through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

    Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which     fix the issue.

    Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115     or later which fix the issue. (CVE-2026-24734)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20350-1 advisory.

    Update to Tomcat 9.0.115:

    - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
    - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
    - CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).
     * Catalina      + Fix: 69623: Additional fix for the long standing regression that meant      that calls to ClassLoader.getResource().getContent() failed when made from      within a web application with resource caching enabled if the target      resource was packaged in a JAR file. (markt)      + Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the      CsrfPreventionFilter. (schultz)      + Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2      requests when the content-length header is not set. (dsoumis)      + Update: Update the minimum and recommended versions for Tomcat Native to      1.3.4. (markt)      + Add: Add a new ssoReauthenticationMode to the Tomcat provided      Authenticators that provides a per Authenticator override of the SSO Valve      requireReauthentication attribute. (markt)      + Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception      rather than silently using a replacement character. (markt)      + Fix: 69871: Increase log level to INFO for missing configuration for the      rewrite valve. (remm)      + Fix: Add log warnings for additional Host appBase suspicious values.
     (remm)      + Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
     org.apache.catalina.Connector no longer requires      org.apache.tomcat.jni.AprStatus to be present. (markt)      + Add: Add the ability to use a custom function to generate the client      identifier in the CrawlerSessionManagerValve. This is only available      programmatically. Pull request #902 by Brian Matzon. (markt)      + Fix: Change the SSO reauthentication behaviour for SPNEGO authentication      so that a normal SPNEGO authentication is performed if the SSL Valve is      configured with reauthentication enabled. This is so that the delegated      credentials will be available to the web application. (markt)      + Fix: When generating the class path in the Loader, re-order the check on      individual class path components to avoid a potential      NullPointerException. Identified by Coverity Scan. (markt)      + Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull      request #915 by Joshua Rogers. (remm)      + Update: Add an attribute, digestInRfc3112Order, to      MessageDigestCredentialHandler to control the order in which the      credential and salt are digested. By default, the current, non-RFC 3112      compliant, order of salt then credential will be used. This default will      change in Tomcat 12 to the RFC 3112 compliant order of credential then      salt. (markt)
     * Cluster      + Add: 62814: Document that human-readable names maybe used for      mapSendOptions and align documentation with channelSendOptions. Based on      pull request #929 by archan0621. (markt)
     * Clustering      + Fix: Correct a regression introduced in 9.0.109 that broke some clustering      configurations. (markt)
     * Coyote      + Fix: Prevent concurrent release of OpenSSLEngine resources and the      termination of the Tomcat Native library as it can cause crashes during      Tomcat shutdown. (markt)      + Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm)      + Fix: Improve warnings when setting ciphers lists in the FFM code,      mirroring the tomcat-native changes. (remm)      + Fix: 69910: Dereference TLS objects right after closing a socket to      improve memory efficiency. (remm)      + Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig      to reflect the existing implementation that allows one configuration style      to be used for the trust attributes and a different style for all the      other attributes. (markt)      + Fix: Better warning message when OpenSSLConf configuration elements are      used with a JSSE TLS implementation. (markt)      + Fix: When using OpenSSL via FFM, don't log a warning about missing CA      certificates unless CA certificates were configured and the configuration      failed. (markt)      + Add: For configuration consistency between OpenSSL and JSSE TLS      implementations, TLSv1.3 cipher suites included in the ciphers attribute      of an SSLHostConfig are now always ignored (previously they would be      ignored with OpenSSL implementations and used with JSSE implementations)      and a warning is logged that the cipher suite has been ignored. (markt)      + Add: Add the ciphersuite attribute to SSLHostConfig to configure the      TLSv1.3 cipher suites. (markt)      + Add: Add OCSP support to JSSE based TLS connectors and make the use of      OCSP configurable per connector for both JSSE and OpenSSL based TLS      implementations. Align the checks performed by OpenSSL with those      performed by JSSE. (markt)      + Add: Add support for soft failure of OCSP checks with soft failure support      disabled by default. (markt)      + Add: Add support for configuring the verification flags passed to      OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)      + Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
     + Fix: Don't log an incorrect certificate KeyStore location when creating a      TLS connector if the KeyStore instance has been set directly on the      connector. (markt)      + Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)      + Add: Add strictSni attribute on the Connector to allow matching the      SSLHostConfig configuration associated with the SNI host name to the      SSLHostConfig configuration matched from the HTTP protocol host name. Non      matching configurations will cause the request to be rejected. The      attribute default value is true, enabling the matching. (remm)      + Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)      + Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL      provider. Pull request #912 by aogburn. (markt)      + Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
     * Jasper      + Fix: 69333: Correct a regression in the previous fix for 69333 and ensure      that reuse() or release() is always called for a tag. (markt)      + Fix: 69877: Catch IllegalArgumentException when processing URIs when      creating the classpath to handle invalid URIs. (remm)      + Fix: Fix populating the classpath with the webapp classloader      repositories. (remm)      + Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some      exception details. Patch submitted by Eric Blanquer. (remm)
     * Jdbc-pool      + Fix: 64083: If the underlying connection has been closed, don't add it to      the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
     * Web applications      + Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server      status output if one or more of the web applications failed to start.
     (schultz)      + Add: Manager: Include web application state in the HTML and JSON complete      server status output. (markt)      + Add: Documentation: Expand the documentation to better explain when OCSP      is supported and when it is not. (markt)
     * Websocket      + Fix: 69920: When attempting to write to a closed Writer or OutputStream      obtained from a WebSocket session, throw an IOException rather than an      IllegalStateExcpetion as required by Writer and strongly suggested by      OutputStream. (markt)
     * Other      + Add: Add property gpg.sign.files to optionally disable release artefact      signing with GPG. (rjung)      + Add: Add test.silent property to suppress JUnit console output during test      execution. Useful for cleaner console output when running tests with      multiple threads. (csutherl)      + Update: Update the internal fork of Commons Pool to 2.13.1. (markt)      + Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)      + Update: Update Commons Daemon to 1.5.1. (markt)      + Update: Update ByteBuddy to 1.18.3. (markt)      + Update: Update UnboundID to 7.0.4. (markt)      + Update: Update Checkstyle to 12.3.1. (markt)      + Add: Improvements to French translations. (markt)      + Add: Improvements to Japanese translations provided by tak7iji. (markt)      + Add: Improvements to Chinese translations provided by Yang. vincent.h and      yong hu. (markt)      + Update: Update Tomcat Native to 1.3.5. (markt)      + Add: Add test profile system for selective test execution. Profiles can be      specified via -Dtest.profile=<name> to run specific test subsets without      using patterns directly. Profile patterns are defined in      test-profiles.properties. (csutherl)      + Update: Update file extension to media type mappings to align with the      current list used by the Apache Web Server (httpd). (markt)      + Update: Update Commons Daemon to 1.5.0. (markt)      + Update: Update Byte Buddy to 1.18.2. (markt)      + Update: Update Checkstyle to 12.2.0. (markt)      + Add: Improvements to Spanish translations provided by White Vogel. (markt)      + Add: Improvements to French translations. (remm)      + Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)      + Update: Update to Byte Buddy 1.17.8. (markt)      + Update: Update to Checkstyle 12.1.1. (markt)      + Update: Update to Jacoco 0.8.14. (markt)      + Update: Update to SpotBugs 4.9.8. (markt)      + Update: Update to JSign 7.4. (markt)      + Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0890-1 advisory.

    Update to Tomcat 10.1.52:

    - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
    - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
    - CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).

    Changelog:

     * Catalina      + Fix: 69623: Additional fix for the long standing regression that meant      that calls to ClassLoader.getResource().getContent() failed when made from      within a web application with resource caching enabled if the target      resource was packaged in a JAR file. (markt)      + Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the      CsrfPreventionFilter. (schultz)      + Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2      requests when the content-length header is not set. (dsoumis)      + Update: Enable minimum and recommended Tomcat Native versions to be set      separately for Tomcat Native 1.x and 2.x. Update the minimum and      recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum      and recommended versions for Tomcat Native 2.x to 2.0.12. (markt)      + Add: Add a new ssoReauthenticationMode to the Tomcat provided      Authenticators that provides a per Authenticator override of the SSO Valve      requireReauthentication attribute. (markt)      + Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception      rather than silently using a replacement character. (markt)      + Fix: 69932: Fix request end access log pattern regression, which would log      the start time of the request instead. (remm)      + Fix: 69871: Increase log level to INFO for missing configuration for the      rewrite valve. (remm)      + Fix: Add log warnings for additional Host appBase suspicious values.
     (remm)      + Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
     org.apache.catalina.Connector no longer requires      org.apache.tomcat.jni.AprStatus to be present. (markt)      + Add: Add the ability to use a custom function to generate the client      identifier in the CrawlerSessionManagerValve. This is only available      programmatically. Pull request #902 by Brian Matzon. (markt)      + Fix: Change the SSO reauthentication behaviour for SPNEGO authentication      so that a normal SPNEGO authentication is performed if the SSL Valve is      configured with reauthentication enabled. This is so that the delegated      credentials will be available to the web application. (markt)      + Fix: When generating the class path in the Loader, re-order the check on      individual class path components to avoid a potential      NullPointerException. Identified by Coverity Scan. (markt)      + Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull      request #915 by Joshua Rogers. (remm)      + Update: Add an attribute, digestInRfc3112Order, to      MessageDigestCredentialHandler to control the order in which the      credential and salt are digested. By default, the current, non-RFC 3112      compliant, order of salt then credential will be used. This default will      change in Tomcat 12 to the RFC 3112 compliant order of credential then      salt. (markt)      + Fix: Log warnings when the SSO configuration does not comply with the      documentation. (remm)      + Update: Deprecate the RemoteAddrFilter and RemoteAddrValve in favour of      the RemoteCIDRFilter and RemoteCIDRValve. (markt)      + Fix: 69837: Fix corruption of the class path generated by the Loader when      running on Windows. (markt)      + Fix: Reject requests that map to invalid Windows file names earlier.
     (markt)      + Fix: 69839: Ensure that changes to session IDs (typically after      authentication) are promulgated to the SSO Valve to ensure that SSO      entries are fully clean-up on session expiration. Patch provided by Kim      Johan Andersson. (markt)      + Fix: Fix a race condition in the creation of the storage location for the      FileStore. (markt)
     * Cluster      + Add: 62814: Document that human-readable names may be used for      mapSendOptions and align documentation with channelSendOptions. Based on      pull request #929 by archan0621. (markt)
     * Clustering      + Fix: Correct a regression introduced in 10.1.45 that broke some clustering      configurations. (markt)
     * Coyote      + Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown      that triggered a significant memory leak. Patch provided by Wes. (markt)      + Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm)      + Fix: Improve warnings when setting ciphers lists in the FFM code,      mirroring the tomcat-native changes. (remm)      + Fix: 69910: Dereference TLS objects right after closing a socket to      improve memory efficiency. (remm)      + Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig      to reflect the existing implementation that allows one configuration style      to be used for the trust attributes and a different style for all the      other attributes. (markt)      + Fix: Better warning message when OpenSSLConf configuration elements are      used with a JSSE TLS implementation. (markt)      + Fix: When using OpenSSL via FFM, don't log a warning about missing CA      certificates unless CA certificates were configured and the configuration      failed. (markt)      + Add: For configuration consistency between OpenSSL and JSSE TLS      implementations, TLSv1.3 cipher suites included in the ciphers attribute      of an SSLHostConfig are now always ignored (previously they would be      ignored with OpenSSL implementations and used with JSSE implementations)      and a warning is logged that the cipher suite has been ignored. (markt)      + Add: Add the ciphersuite attribute to SSLHostConfig to configure the      TLSv1.3 cipher suites. (markt)      + Add: Add OCSP support to JSSE based TLS connectors and make the use of      OCSP configurable per connector for both JSSE and OpenSSL based TLS      implementations. Align the checks performed by OpenSSL with those      performed by JSSE. (markt)      + Add: Add support for soft failure of OCSP checks with soft failure support      disabled by default. (markt)      + Add: Add support for configuring the verification flags passed to      OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)      + Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
     + Fix: Prevent concurrent release of OpenSSLEngine resources and the      termination of the Tomcat Native library as it can cause crashes during      Tomcat shutdown. (markt)      + Fix: Don't log an incorrect certificate KeyStore location when creating a      TLS connector if the KeyStore instance has been set directly on the      connector. (markt)      + Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)      + Add: Add strictSni attribute on the Connector to allow matching the      SSLHostConfig configuration associated with the SNI host name to the      SSLHostConfig configuration matched from the HTTP protocol host name. Non      matching configurations will cause the request to be rejected. The      attribute default value is true, enabling the matching. (remm)      + Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)      + Fix: Fix use of deferAccept attribute in JMX, since it is normally only      removed in Tomcat 11. (remm)      + Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL      provider. Pull request #912 by aogburn. (markt)      + Fix: Fix potential crash on shutdown when a Connector depends on the      Tomcat Native library. (markt)      + Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
     + Fix: 69848: Fix copy/paste errors in 10.1.47 that meant DELETE requests      received via the AJP connector were processed as OPTIONS requests and      PROPFIND requests were processed as TRACE. (markt)      + Fix: Various OCSP processing issues in the OpenSSL FFM code. (dsoumis)
     * General      + Add: Add test.silent property to suppress JUnit console output during test      execution. Useful for cleaner console output when running tests with      multiple threads. (csutherl)
     * Jasper      + Fix: 69333: Correct a regression in the previous fix for 69333 and ensure      that reuse() or release() is always called for a tag. (markt)      + Fix: 69877: Catch IllegalArgumentException when processing URIs when      creating the classpath to handle invalid URIs. (remm)      + Fix: Fix populating the classpath with the webapp classloader      repositories. (remm)      + Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some      exception details. Patch submitted by Eric Blanquer. (remm)
     * Jdbc-pool      + Fix: 64083: If the underlying connection has been closed, don't add it to      the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
     * Web applications      + Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server      status output if one or more of the web applications failed to start.
     (schultz)      + Add: Manager: Include web application state in the HTML and JSON complete      server status output. (markt)      + Add: Documentation: Expand the documentation to better explain when OCSP      is supported and when it is not. (markt)
     * Websocket      + Fix: 69920: When attempting to write to a closed Writer or OutputStream      obtained from a WebSocket session, throw an IOException rather than an      IllegalStateExcpetion as required by Writer and strongly suggested by      OutputStream. (markt)      + Fix: 69845: When using permessage-deflate with Java 25 onwards, handle the      underlying Inflater and/or Deflater throwing IllegalStateException when      closed rather than NullPointerException as they do in Java 24 and earlier.
     * Other      + Update: Update the internal fork of Commons Pool to 2.13.1. (markt)      + Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)      + Update: Update Commons Daemon to 1.5.1. (markt)      + Update: Update ByteBuddy to 1.18.3. (markt)      + Update: Update UnboundID to 7.0.4. (markt)      + Update: Update Checkstyle to 12.3.1. (markt)      + Add: Improvements to French translations. (markt)      + Add: Improvements to Japanese translations provided by tak7iji. (markt)      + Add: Improvements to Chinese translations provided by Yang. vincent.h and      yong hu. (markt)      + Update: Update Tomcat Native to 2.0.12. (markt)      + Add: Add property 'gpg.sign.files' to optionally disable release artefact      signing with GPG. (rjung)      + Add: Add test profile system for selective test execution. Profiles can be      specified via -Dtest.profile=<name> to run specific test subsets without      using patterns directly. Profile patterns are defined in      test-profiles.properties. (csutherl)      + Update: Update file extension to media type mappings to align with the      current list used by the Apache Web Server (httpd). (markt)      + Update: Update the packaged version of the Tomcat Migration Tool for      Jakarta EE to 1.0.10. (markt)      + Update: Update Commons Daemon to 1.5.0. (markt)      + Update: Update Byte Buddy to 1.18.2. (markt)      + Update: Update Checkstyle to 12.2.0. (markt)      + Add: Improvements to Spanish translations provided by White Vogel. (markt)      + Add: Improvements to French translations. (remm)      + Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)      + Update: Update to Byte Buddy 1.17.8. (markt)      + Update: Update to Checkstyle 12.1.1. (markt)      + Update: Update to Jacoco 0.8.14. (markt)      + Update: Update to SpotBugs 4.9.8. (markt)      + Update: Update to JSign 7.4. (markt)      + Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0877-1 advisory.

    Update to Tomcat 11.0.18:

    - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
    - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
    - CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).

    Changelog:

     * Catalina      + Fix: 69932: Fix request end access log pattern regression, which would log      the start time of the request instead. (remm)      + Fix: 69623: Additional fix for the long standing regression that meant      that calls to ClassLoader.getResource().getContent() failed when made from      within a web application with resource caching enabled if the target      resource was packaged in a JAR file. (markt)      + Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the      CsrfPreventionFilter. (schultz)      + Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2      requests when the content-length header is not set. (dsoumis)      + Update: Enable minimum and recommended Tomcat Native versions to be set      separately for Tomcat Native 1.x and 2.x. Update the minimum and      recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum      and recommended versions for Tomcat Native 2.x to 2.0.12. (markt)      + Add: Add a new ssoReauthenticationMode to the Tomcat provided      Authenticators that provides a per Authenticator override of the SSO Valve      requireReauthentication attribute. (markt)      + Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception      rather than silently using a replacement character. (markt)      + Fix: 69871: Increase log level to INFO for missing configuration for the      rewrite valve. (remm)      + Fix: Add log warnings for additional Host appBase suspicious values.
     (remm)      + Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
     org.apache.catalina.Connector no longer requires      org.apache.tomcat.jni.AprStatus to be present. (markt)      + Add: Add the ability to use a custom function to generate the client      identifier in the CrawlerSessionManagerValve. This is only available      programmatically. Pull request #902 by Brian Matzon. (markt)      + Fix: Change the SSO reauthentication behaviour for SPNEGO authentication      so that a normal SPNEGO authentication is performed if the SSL Valve is      configured with reauthentication enabled. This is so that the delegated      credentials will be available to the web application. (markt)      + Fix: When generating the class path in the Loader, re-order the check on      individual class path components to avoid a potential      NullPointerException. Identified by Coverity Scan. (markt)      + Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull      request #915 by Joshua Rogers. (remm)      + Update: Add an attribute, digestInRfc3112Order, to      MessageDigestCredentialHandler to control the order in which the      credential and salt are digested. By default, the current, non-RFC 3112      compliant, order of salt then credential will be used. This default will      change in Tomcat 12 to the RFC 3112 compliant order of credential then      salt. (markt)
     * Cluster      + Add: 62814: Document that human-readable names may be used for      mapSendOptions and align documentation with channelSendOptions. Based on      pull request #929 by archan0621. (markt)
     * Clustering      + Fix: Correct a regression introduced in 11.0.11 that broke some clustering      configurations. (markt)
     * Coyote      + Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown      that triggered a significant memory leak. Patch provided by Wes. (markt)      + Fix: Prevent concurrent release of OpenSSLEngine resources and the      termination of the Tomcat Native library as it can cause crashes during      Tomcat shutdown. (markt)      + Fix: Improve warnings when setting ciphers lists in the FFM code,      mirroring the tomcat-native changes. (remm)      + Fix: 69910: Dereference TLS objects right after closing a socket to      improve memory efficiency. (remm)      + Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig      to reflect the existing implementation that allows one configuration style      to be used for the trust attributes and a different style for all the      other attributes. (markt)      + Fix: Better warning message when OpenSSLConf configuration elements are      used with a JSSE TLS implementation. (markt)      + Fix: When using OpenSSL via FFM, don't log a warning about missing CA      certificates unless CA certificates were configured and the configuration      failed. (markt)      + Add: For configuration consistency between OpenSSL and JSSE TLS      implementations, TLSv1.3 cipher suites included in the ciphers attribute      of an SSLHostConfig are now always ignored (previously they would be      ignored with OpenSSL implementations and used with JSSE implementations)      and a warning is logged that the cipher suite has been ignored. (markt)      + Add: Add the ciphersuite attribute to SSLHostConfig to configure the      TLSv1.3 cipher suites. (markt)      + Add: Add OCSP support to JSSE based TLS connectors and make the use of      OCSP configurable per connector for both JSSE and OpenSSL based TLS      implementations. Align the checks performed by OpenSSL with those      performed by JSSE. (markt)      + Add: Add support for soft failure of OCSP checks with soft failure support      disabled by default. (markt)      + Add: Add support for configuring the verification flags passed to      OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)      + Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
     + Fix: Don't log an incorrect certificate KeyStore location when creating a      TLS connector if the KeyStore instance has been set directly on the      connector. (markt)      + Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)      + Add: Add strictSni attribute on the Connector to allow matching the      SSLHostConfig configuration associated with the SNI host name to the      SSLHostConfig configuration matched from the HTTP protocol host name. Non      matching configurations will cause the request to be rejected. The      attribute default value is true, enabling the matching. (remm)      + Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)      + Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL      provider. Pull request #912 by aogburn. (markt)      + Fix: Fix potential crash on shutdown when a Connector depends on the      Tomcat Native library. (markt)      + Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
     * Jasper      + Fix: 69333: Correct a regression in the previous fix for 69333 and ensure      that reuse() or release() is always called for a tag. (markt)      + Fix: 69877: Catch IllegalArgumentException when processing URIs when      creating the classpath to handle invalid URIs. (remm)      + Fix: Fix populating the classpath with the webapp classloader      repositories. (remm)      + Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some      exception details. Patch submitted by Eric Blanquer. (remm)
     * Jdbc-pool      + Fix: 64083: If the underlying connection has been closed, don't add it to      the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
     * Web applications      + Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server      status output if one or more of the web applications failed to start.
     (schultz)      + Add: Manager: Include web application state in the HTML and JSON complete      server status output. (markt)      + Add: Documentation: Expand the documentation to better explain when OCSP      is supported and when it is not. (markt)
     * Websocket      + Fix: 69920: When attempting to write to a closed Writer or OutputStream      obtained from a WebSocket session, throw an IOException rather than an      IllegalStateExcpetion as required by Writer and strongly suggested by      OutputStream. (markt)
     * Other      + Add: Add property 'gpg.sign.files' to optionally disable release artefact      signing with GPG. (rjung)      + Add: Add test.silent property to suppress JUnit console output during test      execution. Useful for cleaner console output when running tests with      multiple threads. (csutherl)      + Update: Update the internal fork of Commons Pool to 2.13.1. (markt)      + Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)      + Update: Update Commons Daemon to 1.5.1. (markt)      + Update: Update to the Eclipse JDT compiler 4.37. (markt)      + Update: Update ByteBuddy to 1.18.3. (markt)      + Update: Update UnboundID to 7.0.4. (markt)      + Update: Update Checkstyle to 12.3.1. (markt)      + Add: Improvements to French translations. (markt)      + Add: Improvements to Japanese translations provided by tak7iji. (markt)      + Add: Improvements to Chinese translations provided by Yang. vincent.h and      yong hu. (markt)      + Update: Update Tomcat Native to 2.0.12. (markt)      + Add: Add test profile system for selective test execution. Profiles can be      specified via -Dtest.profile=<name> to run specific test subsets without      using patterns directly. Profile patterns are defined in      test-profiles.properties. (csutherl)      + Update: Update file extension to media type mappings to align with the      current list used by the Apache Web Server (httpd). (markt)      + Update: Update the packaged version of the Tomcat Migration Tool for      Jakarta EE to 1.0.10. (markt)      + Update: Update Commons Daemon to 1.5.0. (markt)      + Update: Update Byte Buddy to 1.18.2. (markt)      + Update: Update Checkstyle to 12.2.0. (markt)      + Add: Improvements to Spanish translations provided by White Vogel. (markt)      + Add: Improvements to French translations. (remm)      + Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)      + Update: Update to Byte Buddy 1.17.8. (markt)      + Update: Update to Checkstyle 12.1.1. (markt)      + Update: Update to Jacoco 0.8.14. (markt)      + Update: Update to SpotBugs 4.9.8. (markt)      + Update: Update to JSign 7.4. (markt)      + Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 9.0.83 prior to 9.0.115, 10.1.0-M7 prior to 10.1.52 or 11.0.0-M1 prior to 11.0.18. It is, therefore, affected by a incomplete OCSP verification checks. When using an OCSP responder, Tomcat's FFM integration with OpenSSL did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.52. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.1.52_security-10 advisory.

  - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP     responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification     or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This     issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat:
    from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following     versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through     1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are     recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat     users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which     fix the issue. (CVE-2026-24734)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.115. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.115_security-9 advisory.

  - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP     responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification     or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This     issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat:
    from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following     versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through     1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are     recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat     users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which     fix the issue. (CVE-2026-24734)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 11.0.18. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_11.0.18_security-11 advisory.

  - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP     responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification     or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This     issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat:
    from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following     versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through     1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are     recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat     users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which     fix the issue. (CVE-2026-24734)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP     responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification     or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This     issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat:
    from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following     versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through     1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are     recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat     users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which     fix the issue. (CVE-2026-24734)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310023	Unity Linux 20.1050e Security Update: tomcat (UTSA-2026-014270)	Nessus	Unity Linux Local Security Checks	high
308349	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.7)	Nessus	Misc.	high
305119	Photon OS 5.0: Apache PHSA-2026-5.0-0798	Nessus	PhotonOS Local Security Checks	high
304861	openSUSE 16 Security Update : tomcat10 (openSUSE-SU-2026:20444-1)	Nessus	SuSE Local Security Checks	high
304284	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2026-1497)	Nessus	Amazon Linux Local Security Checks	medium
304279	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2026-1496)	Nessus	Amazon Linux Local Security Checks	medium
304226	openSUSE 16 Security Update : tomcat11 (openSUSE-SU-2026:20414-1)	Nessus	SuSE Local Security Checks	medium
303629	RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 6.2.1 (RHSA-2026:5611)	Nessus	Red Hat Local Security Checks	high
303144	SUSE SLES15 / openSUSE 15 Security Update : tomcat (SUSE-SU-2026:0932-1)	Nessus	SuSE Local Security Checks	medium
303081	Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2026-024 (ALASTOMCAT9-2026-024)	Nessus	Amazon Linux Local Security Checks	medium
302339	openSUSE 16 Security Update : tomcat (openSUSE-SU-2026:20350-1)	Nessus	SuSE Local Security Checks	medium
302254	SUSE SLES15 / openSUSE 15 Security Update : tomcat10 (SUSE-SU-2026:0890-1)	Nessus	SuSE Local Security Checks	medium
302104	SUSE SLES15 / openSUSE 15 Security Update : tomcat11 (SUSE-SU-2026:0877-1)	Nessus	SuSE Local Security Checks	medium
115151	Apache Tomcat 9.0.83 < 9.0.115 Incomplete OCSP Verification Checks	Web App Scanning	Component Vulnerability	high
115150	Apache Tomcat 10.1.0-M7 < 10.1.52 Incomplete OCSP Verification Checks	Web App Scanning	Component Vulnerability	high
115149	Apache Tomcat 11.0.0-M1 < 11.0.18 Incomplete OCSP Verification Checks	Web App Scanning	Component Vulnerability	high
299410	Apache Tomcat 10.1.0.M7 < 10.1.52	Nessus	Web Servers	high
299402	Apache Tomcat 9.0.83 < 9.0.115	Nessus	Web Servers	high
299398	Apache Tomcat 11.0.0.M1 < 11.0.18	Nessus	Web Servers	high
299376	Linux Distros Unpatched Vulnerability : CVE-2026-24734	Nessus	Misc.	high

Detections

Analytics

CVE-2026-24734

high

Tenable Plugins

high

high

high

high

medium

medium

medium

high

medium

medium

medium

medium

medium

high

high

high

high

high

high

high