Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3087-1 advisory.

    This update for tomcat11 fixes the following issues

    Update to Tomcat 11.0.23.

    Security issues fixed:

    - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example     (bsc#1269791).
    - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR     conditions to be       skipped if the first condition in an OR chain matched (bsc#1269910).
    - CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector     (bsc#1269824).
    - CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty     authorization constraints       to not be included when the effective web.xml was logged (bsc#1269909).
    - CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the     cluster       component (bsc#1269908).
    - CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet     ignoring any       method or method omission configured as part of the constraint (bsc#1269907).

    Other updates and bugfixes:

    - Upgrade libtcnative to v2 (bsc#1232390).
    - Tomcat 11.0.23:
      * Catalina
        - Add: Add support for literal '%' characters in access log output. Based on           pull request #1002 by Fabian Hahn. (markt)
        - Fix: Lower the log level to debug when OpenSSL initialization fails in           OpenSSLLifecycleListener to avoid stack traces when libssl.so is not           present and to align the behavior of the isAvailable() check with the           AprLifecycleListener and gracefully fail when natives are not present.
          (csutherl)
        - Fix: 70038: Cookie.clone() should also clone the internal attribute map.
          (markt)
        - Code: Remove unnecessary code from the SSI processing engine that was           duplicating some of the normalisation checks. (markt)
        - Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
        - Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
          (remm)
        - Fix: Incorrect session average life calculation. (remm)
        - Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
          (remm)
        - Fix: Avoid any init parameter updates when conflicts are found for           filters, similar to what is done for servlets, as required by the servlet           specification. (remm)
        - Fix: Fix container event cleanups in some edge cases. (remm)
        - Fix: Check for last-modified header in ExpiresFilter when a servlet uses           addDateHeader to avoid wrongly considering it has been set. (remm)
        - Fix: Fix hour unit used by ExpiresFilter. (remm)
        - Fix: Remove exception swallowing in DataSourceStore to align it with           FileStore and avoid session loss on errors. (remm)
        - Fix: Add support for single-quote escaped literal as well as quoted           literals in DateFormatCache. (schultz)
        - Fix: On JAAS logout, clear out role principals on the subject that were           added on commit, as recommended by the JAAS specification. (remm)
        - Fix: MemoryRealm should not add a dummy role when none is specified in the           configuration. (remm)
        - Fix: DataSourceUserDatabase should return a null principal on a non           existing user. (remm)
        - Fix: Fix shared lock expiration in WebDAV. (remm)
        - Fix: Inaccurate session exipration statistics when using the persistent           manager. (remm)
        - Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
        - Fix: Mixup of WrapperListener and WrapperLifecycle elements in           storeconfig. (remm)
        - Fix: Incorrect processing of modified users in DataSourceUserDatabase.
          (remm)
        - Update: Clarify behavior in the UserDatabase for user, role and group           creation that it does not immediately override existing elements. Removal           (or update) needs to be used instead. (remm)
        - Fix: 70049: Align the web application class loader with parent class           loaders and swallow any errors caused by invalid paths when looking up           resources and behave as if the resources were not found in that case.
          (markt)         + Fix: Improve validation of Range and Content-Range parsers so invalid           ranges trigger a 4xx response rather than a 500 response. Pull request           #1012 provided by Sahana Surendra Bogar. (markt)         + Fix: Fix connection leak in ProxyErrorReportValve. (remm)         + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off           rather than true or false to align with httpd. (markt)         + Fix: Reset the encoding used for query string parameters between requests           in case an application changed the encoding in a previous request. (markt)         + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce           to URLs that are known not to require it. (markt)         + Fix: Fix SSO cookie partitioned configuration. (remm)         + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least           one sub realm is available. (remm)         + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
          (markt)         + Fix: Improve the detection of cross-context dispatches when using a           RequestDispatcher. (markt)         + Fix: Fix various instances of double decoding of URL patterns configured           either programmatically or in web.xml. (remm/markt)         + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,           which follows a purely sequential evaluation strategy. (remm)         + Fix: Update default web.xml version to match supported Servlet           specification version. (markt)         + Fix: Change the default for the useRedirect attribute of the           ProxyErrorReportValve from true to false. (markt)         + Add: Add support for the showReport attribute in JsonErrorReportValve and           ProxyErrorReportValve. When set to false, detailed error information           (message, description, stack trace) is suppressed from error responses.
          (dsoumis)         + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is           removed but catalina-ha.jar is present and the Cluster element is enabled           in server.xml. Cluster digester rules are now fully conditional on both           JARs being available. (dsoumis)         + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)         + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list           of reserved prefixes for SSI variables and request attributes. (markt)         + Fix: Missing URL decoding when processing addMapping on a Servlet           registration. (remm)         + Fix: The Timeout WebDAV header allows comma separated values (according to           the examples in the RFC). Use the first acceptable value. (remm)         + Fix: Fix various issues when logging the effective web.xml for a web           application. Empty sections are no longer logged. Special roles and empty           authorisation constraints are included. All session cookie attributes are           included. (markt)         + Fix: Expand the write lock for the save process in the MemoryUserDatabase           to avoid concurrency issues with the file save operations. (markt)         + Fix: Ensure atomic session persistence in FileStore. Based on pull request           #1016 by sahvx655-wq. (markt)         + Fix: Do not ignore methods configured on security constraints that map to           the default servlet. (markt)
      * Cluster         + Fix: Expand wording and increase visibility of log message when cloud           membership is configured without a trust store as all certificates will be           trusted in this configuration. (markt)         + Fix: Ensure listeners are correctly added and removed when configuring the           channel coordinator. (markt)         + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)         + Fix: Fix some concurrency issues in OrderInterceptor. (markt)         + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)         + Fix: Fix concurrency issues generating MD5 digests in the           CloudMembershipProvider implementations. (markt)         + Add: Add replay protection to the EncryptInterceptor. This us a breaking           change for the EncryptInterceptor.(markt)
      * Coyote         + Add: Log a suitable warning if an encrypted PEM file is detected using an           insecure form for encryption. (markt)         + Fix: If TLS groups have been configured, use the configured groups rather           than using OpenSSL's default TLS groups when using Tomcat Native with           OpenSSL based connectors. (markt)         + Fix: For HTTP/2, ensure that any in progress request body reads are           cancelled if the container resets the associated stream. This prevents           delays waiting for reads to time out when it is known that no more data           will be received. (markt)         + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream           reset do so, rather than triggered a connection close. (markt)         + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)         + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,           following refactor clean-up of header buffer. (remm)         + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)         + Fix: Fix MessageByte.equals if called on a null MB. (remm)         + Fix: Call the delegate key manager in JSSE to retrieve the server key.
          (remm)         + Fix: Avoid overflow scenarios in Asn1Parser. (remm)         + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that           allows the consistency check for the scheme provided by the user agent to           be bypassed. (markt)         + Fix: isTrailerFieldsReady was always returning true. (remm)         + Fix: Align OpenSSL/Panama TLS implementation with other implementations           and throw an exception if there is an error loading the provided CRL(s).
          (markt)         + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if           @STRENGTH was encountered, ignoring any subsequent expressions. (markt)         + Fix: Handle the case where the HTTP/2 payload length is insufficient for           the mandatory data required by the flags set in the header. (markt)         + Fix: 70102: Correct expected size of ticket keys when calling           setSessionTicketKeys with an FFM connector. (markt)         + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken           by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)         + Fix: When processing an OpenSSL cipher specification, fully align the           order of the resulting ciphers with the order produced by OpenSSL. (markt)         + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
          (schultz)         + Update: Update both the minimum and recommended version for Tomcat Native           2.x to 2.0.15. (markt)         + Update: Update the minimum version for Tomcat Native 1.x to 1.3.8. (markt)
      * Jasper         + Fix: Fix possible EL argument mismatch when it was set to null. (remm)         + Fix: Fix thread safety of TagPluginManager. (remm)         + Fix: Correctly use flush on JSP include. (remm)
      * Web applications         + Add: Manager: Add checks to ensure that any uploaded files are uploaded to           the expected location. (markt)         + Add: Manager: Add checks to ensure that the requested context path for a           deployed WAR, directory or descriptor file is valid. (markt)         + Add: Documentation: Expand the description of some of the attributes of           the CrawlerSessionManagerValve. (markt)         + Fix: Documentation: Clearer description and correct documented default for           ocspSoftFail. (markt)         + Fix: Fix double escaping in the context names for the JSON mode of the           manager servlet. (remm)         + Fix: Manager: Ensure automatic deployment does not trigger an undeployment           during a Manager triggered web application reload. (markt)         + Fix: Documentation: Provide better documentation for the scheme and secure           attributes of a Connector. (markt)
      * Websocket         + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)         + Fix: Trigger standard WebSocket error handling if a call to           Endpoint.onOpen() fails for a programmatic endpoint. (markt)         + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a           programmatic endpoint. Test case provided by uabdur. (markt)         + Fix: If a client presents invalid parameters when negotiating a WebSocket           extension, decline the negotiation offer that includes the invalid           parameters rather than failing the connection. Pull request #1019 provided           by sahvx655-wq. (markt)
      * Other         + Fix: Use per connection authenticator when executing an Ant task.
          (remm/markt)         + Update: Update Commons Daemon to 1.6.1. (markt)         + Fix: Prevent duplicate log messages when clustering JARs are not present           on startup. (csutherl)         + Update: Improvements to French translations. (remm)         + Update: Improvements to Japanese translations provided by tak7iji. (markt)         + Update: Update the packaged version of the Tomcat Migration Tool for           Jakarta EE to 1.0.12. (markt)         + Update: Update Tomcat Native to 2.0.15. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3088-1 advisory.

    This update for tomcat fixes the following issues

    Update to Tomcat 9.0.119.

    Security issues fixed:

    - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example     (bsc#1269791).
    - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR     conditions to be       skipped if the first condition in an OR chain matched (bsc#1269910).
    - CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector     (bsc#1269824).
    - CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty     authorization constraints       to not be included when the effective web.xml was logged (bsc#1269909).
    - CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the     cluster       component (bsc#1269908).
    - CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet     ignoring any       method or method omission configured as part of the constraint (bsc#1269907).

    Other updates and bugfixes:

    - Tomcat 9.0.119:
      * Catalina
        - Add: Add support for literal '%' characters in access log output. Based on           pull request #1002 by Fabian Hahn. (markt)
        - Fix: Prevent duplicate log messages when clustering JARs are not present           on startup. (csutherl)
        - Code: Remove unnecessary code from the SSI processing engine that was           duplicating some of the normalisation checks. (markt)
        - Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
        - Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
          (remm)
        - Fix: Incorrect session average life calculation. (remm)
        - Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
          (remm)
        - Fix: Avoid any init parameter updates when conflicts are found for           filters, similar to what is done for servlets, as required by the servlet           specification. (remm)
        - Fix: Fix container event cleanups in some edge cases. (remm)
        - Fix: Check for last-modified header in ExpiresFilter when a servlet uses           addDateHeader to avoid wrongly considering it has been set. (remm)
        - Fix: Fix hour unit used by ExpiresFilter. (remm)
        - Fix: Remove exception swallowing in DataSourceStore to align it with           FileStore and avoid session loss on errors. (remm)
        - Fix: Add support for single-quote escaped literal as well as quoted           literals in DateFormatCache. (schultz)
        - Fix: On JAAS logout, clear out role principals on the subject that were           added on commit, as recommended by the JAAS specification. (remm)
        - Fix: MemoryRealm should not add a dummy role when none is specified in the           configuration. (remm)
        - Fix: DataSourceUserDatabase should return a null principal on a non           existing user. (remm)
        - Fix: Fix shared lock expiration in WebDAV. (remm)
        - Fix: Inaccurate session exipration statistics when using the persistent           manager. (remm)
        - Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
        - Fix: Mixup of WrapperListener and WrapperLifecycle elements in           storeconfig. (remm)
        - Fix: Incorrect processing of modified users in DataSourceUserDatabase.
          (remm)
        - Update: Clarify behavior in the UserDatabase for user, role and group           creation that it does not immediately override existing elements. Removal           (or update) needs to be used instead. (remm)
        - Fix: 70049: Align the web application class loader with parent class           loaders and swallow any errors caused by invalid paths when looking up           resources and behave as if the resources were not found in that case.
          (markt)
        - Fix: Improve validation of Range and Content-Range parsers so invalid           ranges trigger a 4xx response rather than a 500 response. Pull request           #1012 provided by Sahana Surendra Bogar. (markt)         + Fix: Fix connection leak in ProxyErrorReportValve. (remm)         + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off           rather than true or false to align with httpd. (markt)         + Fix: Reset the encoding used for query string parameters between requests           in case an application changed the encoding in a previous request. (markt)         + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce           to URLs that are known not to require it. (markt)         + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least           one sub realm is available. (remm)         + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
          (markt)         + Fix: Improve the detection of cross-context dispatches when using a           RequestDispatcher. (markt)         + Fix: Fix various instances of double decoding of URL patterns configured           either programmatically or in web.xml. (remm/markt)         + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,           which follows a purely sequential evaluation strategy. (remm)         + Fix: Change the default for the useRedirect attribute of the           ProxyErrorReportValve from true to false. (markt)         + Add: Add support for the showReport attribute in JsonErrorReportValve and           ProxyErrorReportValve. When set to false, detailed error information           (message, description, stack trace) is suppressed from error responses.
          (dsoumis)         + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is           removed but catalina-ha.jar is present and the Cluster element is enabled           in server.xml. Cluster digester rules are now fully conditional on both           JARs being available. (dsoumis)         + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)         + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list           of reserved prefixes for SSI variables and request attributes. (markt)         + Fix: Missing URL decoding when processing addMapping on a Servlet           registration. (remm)         + Fix: The Timeout WebDAV header allows comma separated values (according to           the examples in the RFC). Use the first acceptable value. (remm)         + Fix: Fix various issues when logging the effective web.xml for a web           application. Empty sections are no longer logged. Special roles and empty           authorisation constraints are included. (markt)         + Fix: Expand the write lock for the save process in the MemoryUserDatabase           to avoid concurrency issues with the file save operations. (markt)         + Fix: Ensure atomic session persistence in FileStore. Based on pull request           #1016 by sahvx655-wq. (markt)         + Fix: Do not ignore methods configured on security constraints that map to           the default servlet. (markt)
      * Cluster         + Fix: Expand wording and increase visibility of log message when cloud           membership is configured without a trust store as all certificates will be           trusted in this configuration. (markt)         + Fix: Ensure listeners are correctly added and removed when configuring the           channel coordinator. (markt)         + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)         + Fix: Fix some concurrency issues in OrderInterceptor. (markt)         + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)         + Fix: Fix concurrency issues generating MD5 digests in the           CloudMembershipProvider implementations. (markt)         + Add: Add replay protection to the EncryptInterceptor. This is a breaking           change for the EncryptInterceptor. (markt)
      * Coyote         + Add: Log a suitable warning if an encrypted PEM file is detected using an           insecure form for encryption. (markt)         + Fix: If TLS groups have been configured, use the configured groups rather           than using OpenSSL's default TLS groups when using Tomcat Native with           OpenSSL based connectors. (markt)         + Fix: For HTTP/2, ensure that any in progress request body reads are           cancelled if the container resets the associated stream. This prevents           delays waiting for reads to time out when it is known that no more data           will be received. (markt)         + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream           reset do so, rather than triggered a connection close. (markt)         + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)         + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,           following refactor clean-up of header buffer. (remm)         + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)         + Fix: Fix MessageByte.equals if called on a null MB. (remm)         + Fix: Call the delegate key manager in JSSE to retrieve the server key.
          (remm)         + Fix: Avoid overflow scenarios in Asn1Parser. (remm)         + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that           allows the consistency check for the scheme provided by the user agent to           be bypassed. (markt)         + Fix: isTrailerFieldsReady was always returning true. (remm)         + Fix: Align OpenSSL/Panama TLS implementation with other implementations           and throw an exception if there is an error loading the provided CRL(s).
          (markt)         + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if           @STRENGTH was encountered, ignoring any subsequent expressions. (markt)         + Fix: Handle the case where the HTTP/2 payload length is insufficient for           the mandatory data required by the flags set in the header. (markt)         + Fix: 70102: Correct expected size of ticket keys when calling           setSessionTicketKeys with an FFM connector. (markt)         + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken           by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)         + Fix: When processing an OpenSSL cipher specification, fully align the           order of the resulting ciphers with the order produced by OpenSSL. (markt)         + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
          (schultz)         + Update: Update both the minimum and recommended version for Tomcat Native           1.x to 1.3.8. (markt)
      * Jasper         + Fix: Fix possible EL argument mismatch when it was set to null. (remm)         + Fix: Fix thread safety of TagPluginManager. (remm)         + Fix: Correctly use flush on JSP include. (remm)
      * Web applications         + Add: Manager: Add checks to ensure that any uploaded files are uploaded to           the expected location. (markt)         + Add: Manager: Add checks to ensure that the requested context path for a           deployed WAR, directory or descriptor file is valid. (markt)         + Add: Documentation: Expand the description of some of the attributes of           the CrawlerSessionManagerValve. (markt)         + Fix: Documentation: Clearer description and correct documented default for           ocspSoftFail. (markt)         + Fix: Fix double escaping in the context names for the JSON mode of the           manager servlet. (remm)         + Fix: Manager: Ensure automatic deployment does not trigger an undeployment           during a Manager triggered web application reload. (markt)         + Fix: Documentation: Provide better documentation for the scheme and secure           attributes of a Connector. (markt)
      * Websocket         + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)         + Fix: Trigger standard WebSocket error handling if a call to           Endpoint.onOpen() fails for a programmatic endpoint. (markt)         + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a           programmatic endpoint. Test case provided by uabdur. (markt)         + Fix: If a client presents invalid parameters when negotiating a WebSocket           extension, decline the negotiation offer that includes the invalid           parameters rather than failing the connection. Pull request #1019 provided           by sahvx655-wq. (markt)
      * Other         + Fix: Wrong references to jakarta instead of javax. (remm)         + Fix: Restore default authenticator to nullafter executing an Ant task.
          (remm)         + Update: Update Commons Daemon to 1.6.1. (markt)         + Update: Improvements to French translations. (remm)         + Update: Improvements to Japanese translations provided by tak7iji. (markt)         + Update: Update Tomcat Native to 1.3.8. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3112-1 advisory.

    This update for tomcat10 fixes the following issues

    Update to Tomcat 10.1.56.

    Security issues fixed:

    - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example     (bsc#1269791).
    - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR     conditions to be       skipped if the first condition in an OR chain matched (bsc#1269910).
    - CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector     (bsc#1269824).
    - CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty     authorization constraints       to not be included when the effective web.xml was logged (bsc#1269909).
    - CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the     cluster       component (bsc#1269908).
    - CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet     ignoring any       method or method omission configured as part of the constraint (bsc#1269907).

    Other updates and bugfixes:

    - Tomcat 10.1.56:
      * Catalina
        - Add: Add support for literal '%' characters in access log output. Based on           pull request #1002 by Fabian Hahn. (markt)
        - Fix: Prevent duplicate log messages when clustering JARs are not present           on startup. (csutherl)
        - Fix: 70038: Cookie.clone() should also clone the internal attribute map.
          (markt)
        - Code: Remove unnecessary code from the SSI processing engine that was           duplicating some of the normalisation checks. (markt)
        - Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
        - Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
          (remm)
        - Fix: Incorrect session average life calculation. (remm)
        - Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
          (remm)
        - Fix: Avoid any init parameter updates when conflicts are found for           filters, similar to what is done for servlets, as required by the servlet           specification. (remm)
        - Fix: Fix container event cleanups in some edge cases. (remm)
        - Fix: Check for last-modified header in ExpiresFilter when a servlet uses           addDateHeader to avoid wrongly considering it has been set. (remm)
        - Fix: Fix hour unit used by ExpiresFilter. (remm)
        - Fix: Remove exception swallowing in DataSourceStore to align it with           FileStore and avoid session loss on errors. (remm)
        - Fix: Add support for single-quote escaped literal as well as quoted           literals in DateFormatCache. (schultz)
        - Fix: On JAAS logout, clear out role principals on the subject that were           added on commit, as recommended by the JAAS specification. (remm)
        - Fix: MemoryRealm should not add a dummy role when none is specified in the           configuration. (remm)
        - Fix: DataSourceUserDatabase should return a null principal on a non           existing user. (remm)
        - Fix: Fix shared lock expiration in WebDAV. (remm)
        - Fix: Inaccurate session exipration statistics when using the persistent           manager. (remm)
        - Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
        - Fix: Mixup of WrapperListener and WrapperLifecycle elements in           storeconfig. (remm)
        - Fix: Incorrect processing of modified users in DataSourceUserDatabase.
          (remm)
        - Update: Clarify behavior in the UserDatabase for user, role and group           creation that it does not immediately override existing elements. Removal           (or update) needs to be used instead. (remm)
        - Fix: 70049: Align the web application class loader with parent class           loaders and swallow any errors caused by invalid paths when looking up           resources and behave as if the resources were not found in that case.
          (markt)         + Fix: Improve validation of Range and Content-Range parsers so invalid           ranges trigger a 4xx response rather than a 500 response. Pull request           #1012 provided by Sahana Surendra Bogar. (markt)         + Fix: Fix connection leak in ProxyErrorReportValve. (remm)         + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off           rather than true or false to align with httpd. (markt)         + Fix: Reset the encoding used for query string parameters between requests           in case an application changed the encoding in a previous request. (markt)         + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce           to URLs that are known not to require it. (markt)         + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least           one sub realm is available. (remm)         + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
          (markt)         + Fix: Improve the detection of cross-context dispatches when using a           RequestDispatcher. (markt)         + Fix: Fix various instances of double decoding of URL patterns configured           either programmatically or in web.xml. (remm/markt)         + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,           which follows a purely sequential evaluation strategy. (remm)         + Fix: Change the default for the useRedirect attribute of the           ProxyErrorReportValve from true to false. (markt)         + Add: Add support for the showReport attribute in JsonErrorReportValve and           ProxyErrorReportValve. When set to false, detailed error information           (message, description, stack trace) is suppressed from error responses.
          (dsoumis)         + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is           removed but catalina-ha.jar is present and the Cluster element is enabled           in server.xml. Cluster digester rules are now fully conditional on both           JARs being available. (dsoumis)         + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)         + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list           of reserved prefixes for SSI variables and request attributes. (markt)         + Fix: Missing URL decoding when processing addMapping on a Servlet           registration. (remm)         + Fix: The Timeout WebDAV header allows comma separated values (according to           the examples in the RFC). Use the first acceptable value. (remm)         + Fix: Fix various issues when logging the effective web.xml for a web           application. Empty sections are no longer logged. Special roles and empty           authorisation constraints are included. All session cookie attributes are           included. (markt)         + Fix: Expand the write lock for the save process in the MemoryUserDatabase           to avoid concurrency issues with the file save operations. (markt)         + Fix: Ensure atomic session persistence in FileStore. Based on pull request           #1016 by sahvx655-wq. (markt)         + Fix: Do not ignore methods configured on security constraints that map to           the default servlet. (markt)
      * Cluster         + Fix: Expand wording and increase visibility of log message when cloud           membership is configured without a trust store as all certificates will be           trusted in this configuration. (markt)         + Fix: Ensure listeners are correctly added and removed when configuring the           channel coordinator. (markt)         + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)         + Fix: Fix some concurrency issues in OrderInterceptor. (markt)         + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)         + Fix: Fix concurrency issues generating MD5 digests in the           CloudMembershipProvider implementations. (markt)         + Add: Add replay protection to the EncryptInterceptor. This is a breaking           change for the EncryptInterceptor. (markt)
      * Coyote         + Add: Log a suitable warning if an encrypted PEM file is detected using an           insecure form for encryption. (markt)         + Fix: If TLS groups have been configured, use the configured groups rather           than using OpenSSL's default TLS groups when using Tomcat Native with           OpenSSL based connectors. (markt)         + Fix: For HTTP/2, ensure that any in progress request body reads are           cancelled if the container resets the associated stream. This prevents           delays waiting for reads to time out when it is known that no more data           will be received. (markt)         + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream           reset do so, rather than triggered a connection close. (markt)         + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)         + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,           following refactor clean-up of header buffer. (remm)         + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)         + Fix: Fix MessageByte.equals if called on a null MB. (remm)         + Fix: Call the delegate key manager in JSSE to retrieve the server key.
          (remm)         + Fix: Avoid overflow scenarios in Asn1Parser. (remm)         + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that           allows the consistency check for the scheme provided by the user agent to           be bypassed. (markt)         + Fix: isTrailerFieldsReady was always returning true. (remm)         + Fix: Align OpenSSL/Panama TLS implementation with other implementations           and throw an exception if there is an error loading the provided CRL(s).
          (markt)         + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if           @STRENGTH was encountered, ignoring any subsequent expressions. (markt)         + Fix: Handle the case where the HTTP/2 payload length is insufficient for           the mandatory data required by the flags set in the header. (markt)         + Fix: 70102: Correct expected size of ticket keys when calling           setSessionTicketKeys with an FFM connector. (markt)         + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken           by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)         + Fix: When processing an OpenSSL cipher specification, fully align the           order of the resulting ciphers with the order produced by OpenSSL. (markt)         + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
          (schultz)         + Update: Update both the minimum and recommended version for Tomcat Native           2.x to 2.0.15. (markt)         + Update: Update the minimum version for Tomcat Native 1.x to 1.3.8. (markt)
      * Jasper         + Fix: Fix possible EL argument mismatch when it was set to null. (remm)         + Fix: Fix thread safety of TagPluginManager. (remm)         + Fix: Correctly use flush on JSP include. (remm)
      * Web applications         + Add: Manager: Add checks to ensure that any uploaded files are uploaded to           the expected location. (markt)         + Add: Manager: Add checks to ensure that the requested context path for a           deployed WAR, directory or descriptor file is valid. (markt)         + Add: Documentation: Expand the description of some of the attributes of           the CrawlerSessionManagerValve. (markt)         + Fix: Documentation: Clearer description and correct documented default for           ocspSoftFail. (markt)         + Fix: Fix double escaping in the context names for the JSON mode of the           manager servlet. (remm)         + Fix: Manager: Ensure automatic deployment does not trigger an undeployment           during a Manager triggered web application reload. (markt)         + Fix: Documentation: Provide better documentation for the scheme and secure           attributes of a Connector. (markt)
      * Websocket         + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)         + Fix: Trigger standard WebSocket error handling if a call to           Endpoint.onOpen() fails for a programmatic endpoint. (markt)         + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a           programmatic endpoint. Test case provided by uabdur. (markt)         + Fix: If a client presents invalid parameters when negotiating a WebSocket           extension, decline the negotiation offer that includes the invalid           parameters rather than failing the connection. Pull request #1019 provided           by sahvx655-wq. (markt)
      * Other         + Fix: Use per connection authenticator when executing an Ant task.
          (remm/markt)         + Update: Update Commons Daemon to 1.6.1. (markt)         + Update: Improvements to French translations. (remm)         + Update: Improvements to Japanese translations provided by tak7iji. (markt)         + Update: Update the packaged version of the Tomcat Migration Tool for           Jakarta EE to 1.0.12. (markt)         + Update: Update Tomcat Native to 2.0.15. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22647-1 advisory.

    This update for tomcat10 fixes the following issues

    Update to Tomcat 10.1.56.

    Security issues fixed:

    - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example     (bsc#1269791).
    - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR     conditions to be       skipped if the first condition in an OR chain matched (bsc#1269910).
    - CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector     (bsc#1269824).
    - CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty     authorization constraints       to not be included when the effective web.xml was logged (bsc#1269909).
    - CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the     cluster       component (bsc#1269908).
    - CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet     ignoring any       method or method omission configured as part of the constraint (bsc#1269907).

    Other updates and bugfixes:

    - Tomcat 10.1.56:
      * Catalina
        - Add: Add support for literal '%' characters in access log output. Based on           pull request #1002 by Fabian Hahn. (markt)
        - Fix: Prevent duplicate log messages when clustering JARs are not present           on startup. (csutherl)
        - Fix: 70038: Cookie.clone() should also clone the internal attribute map.
          (markt)
        - Code: Remove unnecessary code from the SSI processing engine that was           duplicating some of the normalisation checks. (markt)
        - Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
        - Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
          (remm)
        - Fix: Incorrect session average life calculation. (remm)
        - Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
          (remm)
        - Fix: Avoid any init parameter updates when conflicts are found for           filters, similar to what is done for servlets, as required by the servlet           specification. (remm)
        - Fix: Fix container event cleanups in some edge cases. (remm)
        - Fix: Check for last-modified header in ExpiresFilter when a servlet uses           addDateHeader to avoid wrongly considering it has been set. (remm)
        - Fix: Fix hour unit used by ExpiresFilter. (remm)
        - Fix: Remove exception swallowing in DataSourceStore to align it with           FileStore and avoid session loss on errors. (remm)
        - Fix: Add support for single-quote escaped literal as well as quoted           literals in DateFormatCache. (schultz)
        - Fix: On JAAS logout, clear out role principals on the subject that were           added on commit, as recommended by the JAAS specification. (remm)
        - Fix: MemoryRealm should not add a dummy role when none is specified in the           configuration. (remm)
        - Fix: DataSourceUserDatabase should return a null principal on a non           existing user. (remm)
        - Fix: Fix shared lock expiration in WebDAV. (remm)
        - Fix: Inaccurate session exipration statistics when using the persistent           manager. (remm)
        - Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
        - Fix: Mixup of WrapperListener and WrapperLifecycle elements in           storeconfig. (remm)
        - Fix: Incorrect processing of modified users in DataSourceUserDatabase.
          (remm)
        - Update: Clarify behavior in the UserDatabase for user, role and group           creation that it does not immediately override existing elements. Removal           (or update) needs to be used instead. (remm)
        - Fix: 70049: Align the web application class loader with parent class           loaders and swallow any errors caused by invalid paths when looking up           resources and behave as if the resources were not found in that case.
          (markt)         + Fix: Improve validation of Range and Content-Range parsers so invalid           ranges trigger a 4xx response rather than a 500 response. Pull request           #1012 provided by Sahana Surendra Bogar. (markt)         + Fix: Fix connection leak in ProxyErrorReportValve. (remm)         + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off           rather than true or false to align with httpd. (markt)         + Fix: Reset the encoding used for query string parameters between requests           in case an application changed the encoding in a previous request. (markt)         + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce           to URLs that are known not to require it. (markt)         + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least           one sub realm is available. (remm)         + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
          (markt)         + Fix: Improve the detection of cross-context dispatches when using a           RequestDispatcher. (markt)         + Fix: Fix various instances of double decoding of URL patterns configured           either programmatically or in web.xml. (remm/markt)         + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,           which follows a purely sequential evaluation strategy. (remm)         + Fix: Change the default for the useRedirect attribute of the           ProxyErrorReportValve from true to false. (markt)         + Add: Add support for the showReport attribute in JsonErrorReportValve and           ProxyErrorReportValve. When set to false, detailed error information           (message, description, stack trace) is suppressed from error responses.
          (dsoumis)         + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is           removed but catalina-ha.jar is present and the Cluster element is enabled           in server.xml. Cluster digester rules are now fully conditional on both           JARs being available. (dsoumis)         + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)         + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list           of reserved prefixes for SSI variables and request attributes. (markt)         + Fix: Missing URL decoding when processing addMapping on a Servlet           registration. (remm)         + Fix: The Timeout WebDAV header allows comma separated values (according to           the examples in the RFC). Use the first acceptable value. (remm)         + Fix: Fix various issues when logging the effective web.xml for a web           application. Empty sections are no longer logged. Special roles and empty           authorisation constraints are included. All session cookie attributes are           included. (markt)         + Fix: Expand the write lock for the save process in the MemoryUserDatabase           to avoid concurrency issues with the file save operations. (markt)         + Fix: Ensure atomic session persistence in FileStore. Based on pull request           #1016 by sahvx655-wq. (markt)         + Fix: Do not ignore methods configured on security constraints that map to           the default servlet. (markt)
      * Cluster         + Fix: Expand wording and increase visibility of log message when cloud           membership is configured without a trust store as all certificates will be           trusted in this configuration. (markt)         + Fix: Ensure listeners are correctly added and removed when configuring the           channel coordinator. (markt)         + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)         + Fix: Fix some concurrency issues in OrderInterceptor. (markt)         + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)         + Fix: Fix concurrency issues generating MD5 digests in the           CloudMembershipProvider implementations. (markt)         + Add: Add replay protection to the EncryptInterceptor. This is a breaking           change for the EncryptInterceptor. (markt)
      * Coyote         + Add: Log a suitable warning if an encrypted PEM file is detected using an           insecure form for encryption. (markt)         + Fix: If TLS groups have been configured, use the configured groups rather           than using OpenSSL's default TLS groups when using Tomcat Native with           OpenSSL based connectors. (markt)         + Fix: For HTTP/2, ensure that any in progress request body reads are           cancelled if the container resets the associated stream. This prevents           delays waiting for reads to time out when it is known that no more data           will be received. (markt)         + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream           reset do so, rather than triggered a connection close. (markt)         + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)         + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,           following refactor clean-up of header buffer. (remm)         + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)         + Fix: Fix MessageByte.equals if called on a null MB. (remm)         + Fix: Call the delegate key manager in JSSE to retrieve the server key.
          (remm)         + Fix: Avoid overflow scenarios in Asn1Parser. (remm)         + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that           allows the consistency check for the scheme provided by the user agent to           be bypassed. (markt)         + Fix: isTrailerFieldsReady was always returning true. (remm)         + Fix: Align OpenSSL/Panama TLS implementation with other implementations           and throw an exception if there is an error loading the provided CRL(s).
          (markt)         + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if           @STRENGTH was encountered, ignoring any subsequent expressions. (markt)         + Fix: Handle the case where the HTTP/2 payload length is insufficient for           the mandatory data required by the flags set in the header. (markt)         + Fix: 70102: Correct expected size of ticket keys when calling           setSessionTicketKeys with an FFM connector. (markt)         + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken           by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)         + Fix: When processing an OpenSSL cipher specification, fully align the           order of the resulting ciphers with the order produced by OpenSSL. (markt)         + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
          (schultz)         + Update: Update both the minimum and recommended version for Tomcat Native           2.x to 2.0.15. (markt)         + Update: Update the minimum version for Tomcat Native 1.x to 1.3.8. (markt)
      * Jasper         + Fix: Fix possible EL argument mismatch when it was set to null. (remm)         + Fix: Fix thread safety of TagPluginManager. (remm)         + Fix: Correctly use flush on JSP include. (remm)
      * Web applications         + Add: Manager: Add checks to ensure that any uploaded files are uploaded to           the expected location. (markt)         + Add: Manager: Add checks to ensure that the requested context path for a           deployed WAR, directory or descriptor file is valid. (markt)         + Add: Documentation: Expand the description of some of the attributes of           the CrawlerSessionManagerValve. (markt)         + Fix: Documentation: Clearer description and correct documented default for           ocspSoftFail. (markt)         + Fix: Fix double escaping in the context names for the JSON mode of the           manager servlet. (remm)         + Fix: Manager: Ensure automatic deployment does not trigger an undeployment           during a Manager triggered web application reload. (markt)         + Fix: Documentation: Provide better documentation for the scheme and secure           attributes of a Connector. (markt)
      * Websocket         + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)         + Fix: Trigger standard WebSocket error handling if a call to           Endpoint.onOpen() fails for a programmatic endpoint. (markt)         + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a           programmatic endpoint. Test case provided by uabdur. (markt)         + Fix: If a client presents invalid parameters when negotiating a WebSocket           extension, decline the negotiation offer that includes the invalid           parameters rather than failing the connection. Pull request #1019 provided           by sahvx655-wq. (markt)
      * Other         + Fix: Use per connection authenticator when executing an Ant task.
          (remm/markt)         + Update: Update Commons Daemon to 1.6.1. (markt)         + Update: Improvements to French translations. (remm)         + Update: Improvements to Japanese translations provided by tak7iji. (markt)         + Update: Update the packaged version of the Tomcat Migration Tool for           Jakarta EE to 1.0.12. (markt)         + Update: Update Tomcat Native to 2.0.15. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22648-1 advisory.

    This update for tomcat11 fixes the following issues

    Update to Tomcat 11.0.23.

    Security issues fixed:

    - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example     (bsc#1269791).
    - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR     conditions to be       skipped if the first condition in an OR chain matched (bsc#1269910).
    - CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector     (bsc#1269824).
    - CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty     authorization constraints       to not be included when the effective web.xml was logged (bsc#1269909).
    - CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the     cluster       component (bsc#1269908).
    - CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet     ignoring any       method or method omission configured as part of the constraint (bsc#1269907).

    Other updates and bugfixes:

    - Upgrade libtcnative to v2 (bsc#1232390)
    - Tomcat 11.0.23:
      * Catalina
        - Add: Add support for literal '%' characters in access log output. Based on           pull request #1002 by Fabian Hahn. (markt)
        - Fix: Lower the log level to debug when OpenSSL initialization fails in           OpenSSLLifecycleListener to avoid stack traces when libssl.so is not           present and to align the behavior of the isAvailable() check with the           AprLifecycleListener and gracefully fail when natives are not present.
          (csutherl)
        - Fix: 70038: Cookie.clone() should also clone the internal attribute map.
          (markt)
        - Code: Remove unnecessary code from the SSI processing engine that was           duplicating some of the normalisation checks. (markt)
        - Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
        - Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
          (remm)
        - Fix: Incorrect session average life calculation. (remm)
        - Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
          (remm)
        - Fix: Avoid any init parameter updates when conflicts are found for           filters, similar to what is done for servlets, as required by the servlet           specification. (remm)
        - Fix: Fix container event cleanups in some edge cases. (remm)
        - Fix: Check for last-modified header in ExpiresFilter when a servlet uses           addDateHeader to avoid wrongly considering it has been set. (remm)
        - Fix: Fix hour unit used by ExpiresFilter. (remm)
        - Fix: Remove exception swallowing in DataSourceStore to align it with           FileStore and avoid session loss on errors. (remm)
        - Fix: Add support for single-quote escaped literal as well as quoted           literals in DateFormatCache. (schultz)
        - Fix: On JAAS logout, clear out role principals on the subject that were           added on commit, as recommended by the JAAS specification. (remm)
        - Fix: MemoryRealm should not add a dummy role when none is specified in the           configuration. (remm)
        - Fix: DataSourceUserDatabase should return a null principal on a non           existing user. (remm)
        - Fix: Fix shared lock expiration in WebDAV. (remm)
        - Fix: Inaccurate session exipration statistics when using the persistent           manager. (remm)
        - Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
        - Fix: Mixup of WrapperListener and WrapperLifecycle elements in           storeconfig. (remm)
        - Fix: Incorrect processing of modified users in DataSourceUserDatabase.
          (remm)
        - Update: Clarify behavior in the UserDatabase for user, role and group           creation that it does not immediately override existing elements. Removal           (or update) needs to be used instead. (remm)
        - Fix: 70049: Align the web application class loader with parent class           loaders and swallow any errors caused by invalid paths when looking up           resources and behave as if the resources were not found in that case.
          (markt)         + Fix: Improve validation of Range and Content-Range parsers so invalid           ranges trigger a 4xx response rather than a 500 response. Pull request           #1012 provided by Sahana Surendra Bogar. (markt)         + Fix: Fix connection leak in ProxyErrorReportValve. (remm)         + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off           rather than true or false to align with httpd. (markt)         + Fix: Reset the encoding used for query string parameters between requests           in case an application changed the encoding in a previous request. (markt)         + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce           to URLs that are known not to require it. (markt)         + Fix: Fix SSO cookie partitioned configuration. (remm)         + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least           one sub realm is available. (remm)         + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
          (markt)         + Fix: Improve the detection of cross-context dispatches when using a           RequestDispatcher. (markt)         + Fix: Fix various instances of double decoding of URL patterns configured           either programmatically or in web.xml. (remm/markt)         + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,           which follows a purely sequential evaluation strategy. (remm)         + Fix: Update default web.xml version to match supported Servlet           specification version. (markt)         + Fix: Change the default for the useRedirect attribute of the           ProxyErrorReportValve from true to false. (markt)         + Add: Add support for the showReport attribute in JsonErrorReportValve and           ProxyErrorReportValve. When set to false, detailed error information           (message, description, stack trace) is suppressed from error responses.
          (dsoumis)         + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is           removed but catalina-ha.jar is present and the Cluster element is enabled           in server.xml. Cluster digester rules are now fully conditional on both           JARs being available. (dsoumis)         + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)         + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list           of reserved prefixes for SSI variables and request attributes. (markt)         + Fix: Missing URL decoding when processing addMapping on a Servlet           registration. (remm)         + Fix: The Timeout WebDAV header allows comma separated values (according to           the examples in the RFC). Use the first acceptable value. (remm)         + Fix: Fix various issues when logging the effective web.xml for a web           application. Empty sections are no longer logged. Special roles and empty           authorisation constraints are included. All session cookie attributes are           included. (markt)         + Fix: Expand the write lock for the save process in the MemoryUserDatabase           to avoid concurrency issues with the file save operations. (markt)         + Fix: Ensure atomic session persistence in FileStore. Based on pull request           #1016 by sahvx655-wq. (markt)         + Fix: Do not ignore methods configured on security constraints that map to           the default servlet. (markt)
      * Cluster         + Fix: Expand wording and increase visibility of log message when cloud           membership is configured without a trust store as all certificates will be           trusted in this configuration. (markt)         + Fix: Ensure listeners are correctly added and removed when configuring the           channel coordinator. (markt)         + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)         + Fix: Fix some concurrency issues in OrderInterceptor. (markt)         + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)         + Fix: Fix concurrency issues generating MD5 digests in the           CloudMembershipProvider implementations. (markt)         + Add: Add replay protection to the EncryptInterceptor. This us a breaking           change for the EncryptInterceptor.(markt)
      * Coyote         + Add: Log a suitable warning if an encrypted PEM file is detected using an           insecure form for encryption. (markt)         + Fix: If TLS groups have been configured, use the configured groups rather           than using OpenSSL's default TLS groups when using Tomcat Native with           OpenSSL based connectors. (markt)         + Fix: For HTTP/2, ensure that any in progress request body reads are           cancelled if the container resets the associated stream. This prevents           delays waiting for reads to time out when it is known that no more data           will be received. (markt)         + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream           reset do so, rather than triggered a connection close. (markt)         + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)         + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,           following refactor clean-up of header buffer. (remm)         + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)         + Fix: Fix MessageByte.equals if called on a null MB. (remm)         + Fix: Call the delegate key manager in JSSE to retrieve the server key.
          (remm)         + Fix: Avoid overflow scenarios in Asn1Parser. (remm)         + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that           allows the consistency check for the scheme provided by the user agent to           be bypassed. (markt)         + Fix: isTrailerFieldsReady was always returning true. (remm)         + Fix: Align OpenSSL/Panama TLS implementation with other implementations           and throw an exception if there is an error loading the provided CRL(s).
          (markt)         + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if           @STRENGTH was encountered, ignoring any subsequent expressions. (markt)         + Fix: Handle the case where the HTTP/2 payload length is insufficient for           the mandatory data required by the flags set in the header. (markt)         + Fix: 70102: Correct expected size of ticket keys when calling           setSessionTicketKeys with an FFM connector. (markt)         + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken           by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)         + Fix: When processing an OpenSSL cipher specification, fully align the           order of the resulting ciphers with the order produced by OpenSSL. (markt)         + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
          (schultz)         + Update: Update both the minimum and recommended version for Tomcat Native           2.x to 2.0.15. (markt)         + Update: Update the minimum version for Tomcat Native 1.x to 1.3.8. (markt)
      * Jasper         + Fix: Fix possible EL argument mismatch when it was set to null. (remm)         + Fix: Fix thread safety of TagPluginManager. (remm)         + Fix: Correctly use flush on JSP include. (remm)
      * Web applications         + Add: Manager: Add checks to ensure that any uploaded files are uploaded to           the expected location. (markt)         + Add: Manager: Add checks to ensure that the requested context path for a           deployed WAR, directory or descriptor file is valid. (markt)         + Add: Documentation: Expand the description of some of the attributes of           the CrawlerSessionManagerValve. (markt)         + Fix: Documentation: Clearer description and correct documented default for           ocspSoftFail. (markt)         + Fix: Fix double escaping in the context names for the JSON mode of the           manager servlet. (remm)         + Fix: Manager: Ensure automatic deployment does not trigger an undeployment           during a Manager triggered web application reload. (markt)         + Fix: Documentation: Provide better documentation for the scheme and secure           attributes of a Connector. (markt)
      * Websocket         + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)         + Fix: Trigger standard WebSocket error handling if a call to           Endpoint.onOpen() fails for a programmatic endpoint. (markt)         + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a           programmatic endpoint. Test case provided by uabdur. (markt)         + Fix: If a client presents invalid parameters when negotiating a WebSocket           extension, decline the negotiation offer that includes the invalid           parameters rather than failing the connection. Pull request #1019 provided           by sahvx655-wq. (markt)
      * Other         + Fix: Use per connection authenticator when executing an Ant task.
          (remm/markt)         + Update: Update Commons Daemon to 1.6.1. (markt)         + Fix: Prevent duplicate log messages when clustering JARs are not present           on startup. (csutherl)         + Update: Improvements to French translations. (remm)         + Update: Improvements to Japanese translations provided by tak7iji. (markt)         + Update: Update the packaged version of the Tomcat Migration Tool for           Jakarta EE to 1.0.12. (markt)         + Update: Update Tomcat Native to 2.0.15. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22646-1 advisory.

    This update for tomcat fixes the following issues

    Update to Tomcat 9.0.119.

    Security issues fixed:

    - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example     (bsc#1269791).
    - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR     conditions to be       skipped if the first condition in an OR chain matched (bsc#1269910).
    - CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector     (bsc#1269824).
    - CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty     authorization constraints       to not be included when the effective web.xml was logged (bsc#1269909).
    - CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the     cluster       component (bsc#1269908).
    - CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet     ignoring any       method or method omission configured as part of the constraint (bsc#1269907).

    Other updates and bugfixes:

    - Tomcat 9.0.119:
      * Catalina
        - Add: Add support for literal '%' characters in access log output. Based on           pull request #1002 by Fabian Hahn. (markt)
        - Fix: Prevent duplicate log messages when clustering JARs are not present           on startup. (csutherl)
        - Code: Remove unnecessary code from the SSI processing engine that was           duplicating some of the normalisation checks. (markt)
        - Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
        - Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
          (remm)
        - Fix: Incorrect session average life calculation. (remm)
        - Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
          (remm)
        - Fix: Avoid any init parameter updates when conflicts are found for           filters, similar to what is done for servlets, as required by the servlet           specification. (remm)
        - Fix: Fix container event cleanups in some edge cases. (remm)
        - Fix: Check for last-modified header in ExpiresFilter when a servlet uses           addDateHeader to avoid wrongly considering it has been set. (remm)
        - Fix: Fix hour unit used by ExpiresFilter. (remm)
        - Fix: Remove exception swallowing in DataSourceStore to align it with           FileStore and avoid session loss on errors. (remm)
        - Fix: Add support for single-quote escaped literal as well as quoted           literals in DateFormatCache. (schultz)
        - Fix: On JAAS logout, clear out role principals on the subject that were           added on commit, as recommended by the JAAS specification. (remm)
        - Fix: MemoryRealm should not add a dummy role when none is specified in the           configuration. (remm)
        - Fix: DataSourceUserDatabase should return a null principal on a non           existing user. (remm)
        - Fix: Fix shared lock expiration in WebDAV. (remm)
        - Fix: Inaccurate session exipration statistics when using the persistent           manager. (remm)
        - Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
        - Fix: Mixup of WrapperListener and WrapperLifecycle elements in           storeconfig. (remm)
        - Fix: Incorrect processing of modified users in DataSourceUserDatabase.
          (remm)
        - Update: Clarify behavior in the UserDatabase for user, role and group           creation that it does not immediately override existing elements. Removal           (or update) needs to be used instead. (remm)
        - Fix: 70049: Align the web application class loader with parent class           loaders and swallow any errors caused by invalid paths when looking up           resources and behave as if the resources were not found in that case.
          (markt)
        - Fix: Improve validation of Range and Content-Range parsers so invalid           ranges trigger a 4xx response rather than a 500 response. Pull request           #1012 provided by Sahana Surendra Bogar. (markt)         + Fix: Fix connection leak in ProxyErrorReportValve. (remm)         + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off           rather than true or false to align with httpd. (markt)         + Fix: Reset the encoding used for query string parameters between requests           in case an application changed the encoding in a previous request. (markt)         + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce           to URLs that are known not to require it. (markt)         + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least           one sub realm is available. (remm)         + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
          (markt)         + Fix: Improve the detection of cross-context dispatches when using a           RequestDispatcher. (markt)         + Fix: Fix various instances of double decoding of URL patterns configured           either programmatically or in web.xml. (remm/markt)         + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,           which follows a purely sequential evaluation strategy. (remm)         + Fix: Change the default for the useRedirect attribute of the           ProxyErrorReportValve from true to false. (markt)         + Add: Add support for the showReport attribute in JsonErrorReportValve and           ProxyErrorReportValve. When set to false, detailed error information           (message, description, stack trace) is suppressed from error responses.
          (dsoumis)         + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is           removed but catalina-ha.jar is present and the Cluster element is enabled           in server.xml. Cluster digester rules are now fully conditional on both           JARs being available. (dsoumis)         + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)         + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list           of reserved prefixes for SSI variables and request attributes. (markt)         + Fix: Missing URL decoding when processing addMapping on a Servlet           registration. (remm)         + Fix: The Timeout WebDAV header allows comma separated values (according to           the examples in the RFC). Use the first acceptable value. (remm)         + Fix: Fix various issues when logging the effective web.xml for a web           application. Empty sections are no longer logged. Special roles and empty           authorisation constraints are included. (markt)         + Fix: Expand the write lock for the save process in the MemoryUserDatabase           to avoid concurrency issues with the file save operations. (markt)         + Fix: Ensure atomic session persistence in FileStore. Based on pull request           #1016 by sahvx655-wq. (markt)         + Fix: Do not ignore methods configured on security constraints that map to           the default servlet. (markt)
      * Cluster         + Fix: Expand wording and increase visibility of log message when cloud           membership is configured without a trust store as all certificates will be           trusted in this configuration. (markt)         + Fix: Ensure listeners are correctly added and removed when configuring the           channel coordinator. (markt)         + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)         + Fix: Fix some concurrency issues in OrderInterceptor. (markt)         + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)         + Fix: Fix concurrency issues generating MD5 digests in the           CloudMembershipProvider implementations. (markt)         + Add: Add replay protection to the EncryptInterceptor. This is a breaking           change for the EncryptInterceptor. (markt)
      * Coyote         + Add: Log a suitable warning if an encrypted PEM file is detected using an           insecure form for encryption. (markt)         + Fix: If TLS groups have been configured, use the configured groups rather           than using OpenSSL's default TLS groups when using Tomcat Native with           OpenSSL based connectors. (markt)         + Fix: For HTTP/2, ensure that any in progress request body reads are           cancelled if the container resets the associated stream. This prevents           delays waiting for reads to time out when it is known that no more data           will be received. (markt)         + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream           reset do so, rather than triggered a connection close. (markt)         + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)         + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,           following refactor clean-up of header buffer. (remm)         + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)         + Fix: Fix MessageByte.equals if called on a null MB. (remm)         + Fix: Call the delegate key manager in JSSE to retrieve the server key.
          (remm)         + Fix: Avoid overflow scenarios in Asn1Parser. (remm)         + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that           allows the consistency check for the scheme provided by the user agent to           be bypassed. (markt)         + Fix: isTrailerFieldsReady was always returning true. (remm)         + Fix: Align OpenSSL/Panama TLS implementation with other implementations           and throw an exception if there is an error loading the provided CRL(s).
          (markt)         + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if           @STRENGTH was encountered, ignoring any subsequent expressions. (markt)         + Fix: Handle the case where the HTTP/2 payload length is insufficient for           the mandatory data required by the flags set in the header. (markt)         + Fix: 70102: Correct expected size of ticket keys when calling           setSessionTicketKeys with an FFM connector. (markt)         + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken           by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)         + Fix: When processing an OpenSSL cipher specification, fully align the           order of the resulting ciphers with the order produced by OpenSSL. (markt)         + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
          (schultz)         + Update: Update both the minimum and recommended version for Tomcat Native           1.x to 1.3.8. (markt)
      * Jasper         + Fix: Fix possible EL argument mismatch when it was set to null. (remm)         + Fix: Fix thread safety of TagPluginManager. (remm)         + Fix: Correctly use flush on JSP include. (remm)
      * Web applications         + Add: Manager: Add checks to ensure that any uploaded files are uploaded to           the expected location. (markt)         + Add: Manager: Add checks to ensure that the requested context path for a           deployed WAR, directory or descriptor file is valid. (markt)         + Add: Documentation: Expand the description of some of the attributes of           the CrawlerSessionManagerValve. (markt)         + Fix: Documentation: Clearer description and correct documented default for           ocspSoftFail. (markt)         + Fix: Fix double escaping in the context names for the JSON mode of the           manager servlet. (remm)         + Fix: Manager: Ensure automatic deployment does not trigger an undeployment           during a Manager triggered web application reload. (markt)         + Fix: Documentation: Provide better documentation for the scheme and secure           attributes of a Connector. (markt)
      * Websocket         + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)         + Fix: Trigger standard WebSocket error handling if a call to           Endpoint.onOpen() fails for a programmatic endpoint. (markt)         + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a           programmatic endpoint. Test case provided by uabdur. (markt)         + Fix: If a client presents invalid parameters when negotiating a WebSocket           extension, decline the negotiation offer that includes the invalid           parameters rather than failing the connection. Pull request #1019 provided           by sahvx655-wq. (markt)
      * Other         + Fix: Wrong references to jakarta instead of javax. (remm)         + Fix: Restore default authenticator to nullafter executing an Ant task.
          (remm)         + Update: Update Commons Daemon to 1.6.1. (markt)         + Update: Improvements to French translations. (remm)         + Update: Improvements to Japanese translations provided by tak7iji. (markt)         + Update: Update Tomcat Native to 1.3.8. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8551-1 advisory.

    It was discovered that Tomcat incorrectly handled authorization when multiple method constraints defined     the same HTTP method. A remote attacker could possibly use this issue to bypass authorization     restrictions. (CVE-2026-43515)

    It was discovered that the Tomcat number guess example application did not properly sanitize user-supplied     input. An attacker could possibly use this issue to inject malicious scripts, resulting in cross-site     scripting. (CVE-2026-50229)

    It was discovered that Tomcat incorrectly evaluated rewrite valve conditions in certain configurations. An     attacker could possibly use this issue to bypass rewrite rules, resulting in unauthorized access.
    (CVE-2026-53404)

    It was discovered that Tomcat incorrectly omitted certain authorization information when logging the     effective web.xml configuration. An attacker could possibly use this issue to hide authorization     constraints, resulting in reduced auditability. (CVE-2026-55276)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21328-1 advisory.

    This update for tomcat10 fixes the following issues

    Update to Tomcat 10.1.56.

    Security issues fixed:

    - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example     (bsc#1269791).
    - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR     conditions to be       skipped if the first condition in an OR chain matched (bsc#1269910).
    - CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector     (bsc#1269824).
    - CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty     authorization constraints       to not be included when the effective web.xml was logged (bsc#1269909).
    - CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the     cluster       component (bsc#1269908).
    - CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet     ignoring any       method or method omission configured as part of the constraint (bsc#1269907).

    Other updates and bugfixes:

    - Tomcat 10.1.56:
      * Catalina
        - Add: Add support for literal '%' characters in access log output. Based on           pull request #1002 by Fabian Hahn. (markt)
        - Fix: Prevent duplicate log messages when clustering JARs are not present           on startup. (csutherl)
        - Fix: 70038: Cookie.clone() should also clone the internal attribute map.
          (markt)
        - Code: Remove unnecessary code from the SSI processing engine that was           duplicating some of the normalisation checks. (markt)
        - Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
        - Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
          (remm)
        - Fix: Incorrect session average life calculation. (remm)
        - Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
          (remm)
        - Fix: Avoid any init parameter updates when conflicts are found for           filters, similar to what is done for servlets, as required by the servlet           specification. (remm)
        - Fix: Fix container event cleanups in some edge cases. (remm)
        - Fix: Check for last-modified header in ExpiresFilter when a servlet uses           addDateHeader to avoid wrongly considering it has been set. (remm)
        - Fix: Fix hour unit used by ExpiresFilter. (remm)
        - Fix: Remove exception swallowing in DataSourceStore to align it with           FileStore and avoid session loss on errors. (remm)
        - Fix: Add support for single-quote escaped literal as well as quoted           literals in DateFormatCache. (schultz)
        - Fix: On JAAS logout, clear out role principals on the subject that were           added on commit, as recommended by the JAAS specification. (remm)
        - Fix: MemoryRealm should not add a dummy role when none is specified in the           configuration. (remm)
        - Fix: DataSourceUserDatabase should return a null principal on a non           existing user. (remm)
        - Fix: Fix shared lock expiration in WebDAV. (remm)
        - Fix: Inaccurate session exipration statistics when using the persistent           manager. (remm)
        - Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
        - Fix: Mixup of WrapperListener and WrapperLifecycle elements in           storeconfig. (remm)
        - Fix: Incorrect processing of modified users in DataSourceUserDatabase.
          (remm)
        - Update: Clarify behavior in the UserDatabase for user, role and group           creation that it does not immediately override existing elements. Removal           (or update) needs to be used instead. (remm)
        - Fix: 70049: Align the web application class loader with parent class           loaders and swallow any errors caused by invalid paths when looking up           resources and behave as if the resources were not found in that case.
          (markt)         + Fix: Improve validation of Range and Content-Range parsers so invalid           ranges trigger a 4xx response rather than a 500 response. Pull request           #1012 provided by Sahana Surendra Bogar. (markt)         + Fix: Fix connection leak in ProxyErrorReportValve. (remm)         + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off           rather than true or false to align with httpd. (markt)         + Fix: Reset the encoding used for query string parameters between requests           in case an application changed the encoding in a previous request. (markt)         + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce           to URLs that are known not to require it. (markt)         + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least           one sub realm is available. (remm)         + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
          (markt)         + Fix: Improve the detection of cross-context dispatches when using a           RequestDispatcher. (markt)         + Fix: Fix various instances of double decoding of URL patterns configured           either programmatically or in web.xml. (remm/markt)         + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,           which follows a purely sequential evaluation strategy. (remm)         + Fix: Change the default for the useRedirect attribute of the           ProxyErrorReportValve from true to false. (markt)         + Add: Add support for the showReport attribute in JsonErrorReportValve and           ProxyErrorReportValve. When set to false, detailed error information           (message, description, stack trace) is suppressed from error responses.
          (dsoumis)         + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is           removed but catalina-ha.jar is present and the Cluster element is enabled           in server.xml. Cluster digester rules are now fully conditional on both           JARs being available. (dsoumis)         + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)         + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list           of reserved prefixes for SSI variables and request attributes. (markt)         + Fix: Missing URL decoding when processing addMapping on a Servlet           registration. (remm)         + Fix: The Timeout WebDAV header allows comma separated values (according to           the examples in the RFC). Use the first acceptable value. (remm)         + Fix: Fix various issues when logging the effective web.xml for a web           application. Empty sections are no longer logged. Special roles and empty           authorisation constraints are included. All session cookie attributes are           included. (markt)         + Fix: Expand the write lock for the save process in the MemoryUserDatabase           to avoid concurrency issues with the file save operations. (markt)         + Fix: Ensure atomic session persistence in FileStore. Based on pull request           #1016 by sahvx655-wq. (markt)         + Fix: Do not ignore methods configured on security constraints that map to           the default servlet. (markt)
      * Cluster         + Fix: Expand wording and increase visibility of log message when cloud           membership is configured without a trust store as all certificates will be           trusted in this configuration. (markt)         + Fix: Ensure listeners are correctly added and removed when configuring the           channel coordinator. (markt)         + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)         + Fix: Fix some concurrency issues in OrderInterceptor. (markt)         + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)         + Fix: Fix concurrency issues generating MD5 digests in the           CloudMembershipProvider implementations. (markt)         + Add: Add replay protection to the EncryptInterceptor. This is a breaking           change for the EncryptInterceptor. (markt)
      * Coyote         + Add: Log a suitable warning if an encrypted PEM file is detected using an           insecure form for encryption. (markt)         + Fix: If TLS groups have been configured, use the configured groups rather           than using OpenSSL's default TLS groups when using Tomcat Native with           OpenSSL based connectors. (markt)         + Fix: For HTTP/2, ensure that any in progress request body reads are           cancelled if the container resets the associated stream. This prevents           delays waiting for reads to time out when it is known that no more data           will be received. (markt)         + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream           reset do so, rather than triggered a connection close. (markt)         + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)         + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,           following refactor clean-up of header buffer. (remm)         + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)         + Fix: Fix MessageByte.equals if called on a null MB. (remm)         + Fix: Call the delegate key manager in JSSE to retrieve the server key.
          (remm)         + Fix: Avoid overflow scenarios in Asn1Parser. (remm)         + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that           allows the consistency check for the scheme provided by the user agent to           be bypassed. (markt)         + Fix: isTrailerFieldsReady was always returning true. (remm)         + Fix: Align OpenSSL/Panama TLS implementation with other implementations           and throw an exception if there is an error loading the provided CRL(s).
          (markt)         + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if           @STRENGTH was encountered, ignoring any subsequent expressions. (markt)         + Fix: Handle the case where the HTTP/2 payload length is insufficient for           the mandatory data required by the flags set in the header. (markt)         + Fix: 70102: Correct expected size of ticket keys when calling           setSessionTicketKeys with an FFM connector. (markt)         + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken           by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)         + Fix: When processing an OpenSSL cipher specification, fully align the           order of the resulting ciphers with the order produced by OpenSSL. (markt)         + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
          (schultz)         + Update: Update both the minimum and recommended version for Tomcat Native           2.x to 2.0.15. (markt)         + Update: Update the minimum version for Tomcat Native 1.x to 1.3.8. (markt)
      * Jasper         + Fix: Fix possible EL argument mismatch when it was set to null. (remm)         + Fix: Fix thread safety of TagPluginManager. (remm)         + Fix: Correctly use flush on JSP include. (remm)
      * Web applications         + Add: Manager: Add checks to ensure that any uploaded files are uploaded to           the expected location. (markt)         + Add: Manager: Add checks to ensure that the requested context path for a           deployed WAR, directory or descriptor file is valid. (markt)         + Add: Documentation: Expand the description of some of the attributes of           the CrawlerSessionManagerValve. (markt)         + Fix: Documentation: Clearer description and correct documented default for           ocspSoftFail. (markt)         + Fix: Fix double escaping in the context names for the JSON mode of the           manager servlet. (remm)         + Fix: Manager: Ensure automatic deployment does not trigger an undeployment           during a Manager triggered web application reload. (markt)         + Fix: Documentation: Provide better documentation for the scheme and secure           attributes of a Connector. (markt)
      * Websocket         + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)         + Fix: Trigger standard WebSocket error handling if a call to           Endpoint.onOpen() fails for a programmatic endpoint. (markt)         + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a           programmatic endpoint. Test case provided by uabdur. (markt)         + Fix: If a client presents invalid parameters when negotiating a WebSocket           extension, decline the negotiation offer that includes the invalid           parameters rather than failing the connection. Pull request #1019 provided           by sahvx655-wq. (markt)
      * Other         + Fix: Use per connection authenticator when executing an Ant task.
          (remm/markt)         + Update: Update Commons Daemon to 1.6.1. (markt)         + Update: Improvements to French translations. (remm)         + Update: Improvements to Japanese translations provided by tak7iji. (markt)         + Update: Update the packaged version of the Tomcat Migration Tool for           Jakarta EE to 1.0.12. (markt)         + Update: Update Tomcat Native to 2.0.15. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21329-1 advisory.

    This update for tomcat11 fixes the following issues

    Update to Tomcat 11.0.23.

    Security issues fixed:

    - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example     (bsc#1269791).
    - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR     conditions to be       skipped if the first condition in an OR chain matched (bsc#1269910).
    - CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector     (bsc#1269824).
    - CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty     authorization constraints       to not be included when the effective web.xml was logged (bsc#1269909).
    - CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the     cluster       component (bsc#1269908).
    - CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet     ignoring any       method or method omission configured as part of the constraint (bsc#1269907).

    Other updates and bugfixes:

    - Upgrade libtcnative to v2 (bsc#1232390)
    - Tomcat 11.0.23:
      * Catalina
        - Add: Add support for literal '%' characters in access log output. Based on           pull request #1002 by Fabian Hahn. (markt)
        - Fix: Lower the log level to debug when OpenSSL initialization fails in           OpenSSLLifecycleListener to avoid stack traces when libssl.so is not           present and to align the behavior of the isAvailable() check with the           AprLifecycleListener and gracefully fail when natives are not present.
          (csutherl)
        - Fix: 70038: Cookie.clone() should also clone the internal attribute map.
          (markt)
        - Code: Remove unnecessary code from the SSI processing engine that was           duplicating some of the normalisation checks. (markt)
        - Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
        - Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
          (remm)
        - Fix: Incorrect session average life calculation. (remm)
        - Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
          (remm)
        - Fix: Avoid any init parameter updates when conflicts are found for           filters, similar to what is done for servlets, as required by the servlet           specification. (remm)
        - Fix: Fix container event cleanups in some edge cases. (remm)
        - Fix: Check for last-modified header in ExpiresFilter when a servlet uses           addDateHeader to avoid wrongly considering it has been set. (remm)
        - Fix: Fix hour unit used by ExpiresFilter. (remm)
        - Fix: Remove exception swallowing in DataSourceStore to align it with           FileStore and avoid session loss on errors. (remm)
        - Fix: Add support for single-quote escaped literal as well as quoted           literals in DateFormatCache. (schultz)
        - Fix: On JAAS logout, clear out role principals on the subject that were           added on commit, as recommended by the JAAS specification. (remm)
        - Fix: MemoryRealm should not add a dummy role when none is specified in the           configuration. (remm)
        - Fix: DataSourceUserDatabase should return a null principal on a non           existing user. (remm)
        - Fix: Fix shared lock expiration in WebDAV. (remm)
        - Fix: Inaccurate session exipration statistics when using the persistent           manager. (remm)
        - Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
        - Fix: Mixup of WrapperListener and WrapperLifecycle elements in           storeconfig. (remm)
        - Fix: Incorrect processing of modified users in DataSourceUserDatabase.
          (remm)
        - Update: Clarify behavior in the UserDatabase for user, role and group           creation that it does not immediately override existing elements. Removal           (or update) needs to be used instead. (remm)
        - Fix: 70049: Align the web application class loader with parent class           loaders and swallow any errors caused by invalid paths when looking up           resources and behave as if the resources were not found in that case.
          (markt)         + Fix: Improve validation of Range and Content-Range parsers so invalid           ranges trigger a 4xx response rather than a 500 response. Pull request           #1012 provided by Sahana Surendra Bogar. (markt)         + Fix: Fix connection leak in ProxyErrorReportValve. (remm)         + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off           rather than true or false to align with httpd. (markt)         + Fix: Reset the encoding used for query string parameters between requests           in case an application changed the encoding in a previous request. (markt)         + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce           to URLs that are known not to require it. (markt)         + Fix: Fix SSO cookie partitioned configuration. (remm)         + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least           one sub realm is available. (remm)         + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
          (markt)         + Fix: Improve the detection of cross-context dispatches when using a           RequestDispatcher. (markt)         + Fix: Fix various instances of double decoding of URL patterns configured           either programmatically or in web.xml. (remm/markt)         + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,           which follows a purely sequential evaluation strategy. (remm)         + Fix: Update default web.xml version to match supported Servlet           specification version. (markt)         + Fix: Change the default for the useRedirect attribute of the           ProxyErrorReportValve from true to false. (markt)         + Add: Add support for the showReport attribute in JsonErrorReportValve and           ProxyErrorReportValve. When set to false, detailed error information           (message, description, stack trace) is suppressed from error responses.
          (dsoumis)         + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is           removed but catalina-ha.jar is present and the Cluster element is enabled           in server.xml. Cluster digester rules are now fully conditional on both           JARs being available. (dsoumis)         + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)         + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list           of reserved prefixes for SSI variables and request attributes. (markt)         + Fix: Missing URL decoding when processing addMapping on a Servlet           registration. (remm)         + Fix: The Timeout WebDAV header allows comma separated values (according to           the examples in the RFC). Use the first acceptable value. (remm)         + Fix: Fix various issues when logging the effective web.xml for a web           application. Empty sections are no longer logged. Special roles and empty           authorisation constraints are included. All session cookie attributes are           included. (markt)         + Fix: Expand the write lock for the save process in the MemoryUserDatabase           to avoid concurrency issues with the file save operations. (markt)         + Fix: Ensure atomic session persistence in FileStore. Based on pull request           #1016 by sahvx655-wq. (markt)         + Fix: Do not ignore methods configured on security constraints that map to           the default servlet. (markt)
      * Cluster         + Fix: Expand wording and increase visibility of log message when cloud           membership is configured without a trust store as all certificates will be           trusted in this configuration. (markt)         + Fix: Ensure listeners are correctly added and removed when configuring the           channel coordinator. (markt)         + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)         + Fix: Fix some concurrency issues in OrderInterceptor. (markt)         + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)         + Fix: Fix concurrency issues generating MD5 digests in the           CloudMembershipProvider implementations. (markt)         + Add: Add replay protection to the EncryptInterceptor. This us a breaking           change for the EncryptInterceptor.(markt)
      * Coyote         + Add: Log a suitable warning if an encrypted PEM file is detected using an           insecure form for encryption. (markt)         + Fix: If TLS groups have been configured, use the configured groups rather           than using OpenSSL's default TLS groups when using Tomcat Native with           OpenSSL based connectors. (markt)         + Fix: For HTTP/2, ensure that any in progress request body reads are           cancelled if the container resets the associated stream. This prevents           delays waiting for reads to time out when it is known that no more data           will be received. (markt)         + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream           reset do so, rather than triggered a connection close. (markt)         + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)         + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,           following refactor clean-up of header buffer. (remm)         + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)         + Fix: Fix MessageByte.equals if called on a null MB. (remm)         + Fix: Call the delegate key manager in JSSE to retrieve the server key.
          (remm)         + Fix: Avoid overflow scenarios in Asn1Parser. (remm)         + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that           allows the consistency check for the scheme provided by the user agent to           be bypassed. (markt)         + Fix: isTrailerFieldsReady was always returning true. (remm)         + Fix: Align OpenSSL/Panama TLS implementation with other implementations           and throw an exception if there is an error loading the provided CRL(s).
          (markt)         + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if           @STRENGTH was encountered, ignoring any subsequent expressions. (markt)         + Fix: Handle the case where the HTTP/2 payload length is insufficient for           the mandatory data required by the flags set in the header. (markt)         + Fix: 70102: Correct expected size of ticket keys when calling           setSessionTicketKeys with an FFM connector. (markt)         + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken           by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)         + Fix: When processing an OpenSSL cipher specification, fully align the           order of the resulting ciphers with the order produced by OpenSSL. (markt)         + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
          (schultz)         + Update: Update both the minimum and recommended version for Tomcat Native           2.x to 2.0.15. (markt)         + Update: Update the minimum version for Tomcat Native 1.x to 1.3.8. (markt)
      * Jasper         + Fix: Fix possible EL argument mismatch when it was set to null. (remm)         + Fix: Fix thread safety of TagPluginManager. (remm)         + Fix: Correctly use flush on JSP include. (remm)
      * Web applications         + Add: Manager: Add checks to ensure that any uploaded files are uploaded to           the expected location. (markt)         + Add: Manager: Add checks to ensure that the requested context path for a           deployed WAR, directory or descriptor file is valid. (markt)         + Add: Documentation: Expand the description of some of the attributes of           the CrawlerSessionManagerValve. (markt)         + Fix: Documentation: Clearer description and correct documented default for           ocspSoftFail. (markt)         + Fix: Fix double escaping in the context names for the JSON mode of the           manager servlet. (remm)         + Fix: Manager: Ensure automatic deployment does not trigger an undeployment           during a Manager triggered web application reload. (markt)         + Fix: Documentation: Provide better documentation for the scheme and secure           attributes of a Connector. (markt)
      * Websocket         + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)         + Fix: Trigger standard WebSocket error handling if a call to           Endpoint.onOpen() fails for a programmatic endpoint. (markt)         + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a           programmatic endpoint. Test case provided by uabdur. (markt)         + Fix: If a client presents invalid parameters when negotiating a WebSocket           extension, decline the negotiation offer that includes the invalid           parameters rather than failing the connection. Pull request #1019 provided           by sahvx655-wq. (markt)
      * Other         + Fix: Use per connection authenticator when executing an Ant task.
          (remm/markt)         + Update: Update Commons Daemon to 1.6.1. (markt)         + Fix: Prevent duplicate log messages when clustering JARs are not present           on startup. (csutherl)         + Update: Improvements to French translations. (remm)         + Update: Improvements to Japanese translations provided by tak7iji. (markt)         + Update: Update the packaged version of the Tomcat Migration Tool for           Jakarta EE to 1.0.12. (markt)         + Update: Update Tomcat Native to 2.0.15. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21327-1 advisory.

    This update for tomcat fixes the following issues

    Update to Tomcat 9.0.119.

    Security issues fixed:

    - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example     (bsc#1269791).
    - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR     conditions to be       skipped if the first condition in an OR chain matched (bsc#1269910).
    - CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector     (bsc#1269824).
    - CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty     authorization constraints       to not be included when the effective web.xml was logged (bsc#1269909).
    - CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the     cluster       component (bsc#1269908).
    - CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet     ignoring any       method or method omission configured as part of the constraint (bsc#1269907).

    Other updates and bugfixes:

    - Tomcat 9.0.119:
      * Catalina
        - Add: Add support for literal '%' characters in access log output. Based on           pull request #1002 by Fabian Hahn. (markt)
        - Fix: Prevent duplicate log messages when clustering JARs are not present           on startup. (csutherl)
        - Code: Remove unnecessary code from the SSI processing engine that was           duplicating some of the normalisation checks. (markt)
        - Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
        - Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
          (remm)
        - Fix: Incorrect session average life calculation. (remm)
        - Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
          (remm)
        - Fix: Avoid any init parameter updates when conflicts are found for           filters, similar to what is done for servlets, as required by the servlet           specification. (remm)
        - Fix: Fix container event cleanups in some edge cases. (remm)
        - Fix: Check for last-modified header in ExpiresFilter when a servlet uses           addDateHeader to avoid wrongly considering it has been set. (remm)
        - Fix: Fix hour unit used by ExpiresFilter. (remm)
        - Fix: Remove exception swallowing in DataSourceStore to align it with           FileStore and avoid session loss on errors. (remm)
        - Fix: Add support for single-quote escaped literal as well as quoted           literals in DateFormatCache. (schultz)
        - Fix: On JAAS logout, clear out role principals on the subject that were           added on commit, as recommended by the JAAS specification. (remm)
        - Fix: MemoryRealm should not add a dummy role when none is specified in the           configuration. (remm)
        - Fix: DataSourceUserDatabase should return a null principal on a non           existing user. (remm)
        - Fix: Fix shared lock expiration in WebDAV. (remm)
        - Fix: Inaccurate session exipration statistics when using the persistent           manager. (remm)
        - Fix: Skip BOM when serving files with UTF-32 encoding. (remm)
        - Fix: Mixup of WrapperListener and WrapperLifecycle elements in           storeconfig. (remm)
        - Fix: Incorrect processing of modified users in DataSourceUserDatabase.
          (remm)
        - Update: Clarify behavior in the UserDatabase for user, role and group           creation that it does not immediately override existing elements. Removal           (or update) needs to be used instead. (remm)
        - Fix: 70049: Align the web application class loader with parent class           loaders and swallow any errors caused by invalid paths when looking up           resources and behave as if the resources were not found in that case.
          (markt)
        - Fix: Improve validation of Range and Content-Range parsers so invalid           ranges trigger a 4xx response rather than a 500 response. Pull request           #1012 provided by Sahana Surendra Bogar. (markt)         + Fix: Fix connection leak in ProxyErrorReportValve. (remm)         + Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off           rather than true or false to align with httpd. (markt)         + Fix: Reset the encoding used for query string parameters between requests           in case an application changed the encoding in a previous request. (markt)         + Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce           to URLs that are known not to require it. (markt)         + Fix: Fix CombinedRealm isAvailable, it allows authentication if at least           one sub realm is available. (remm)         + Fix: 70048: Correctly handle asynchronous requests in PersistentValve.
          (markt)         + Fix: Improve the detection of cross-context dispatches when using a           RequestDispatcher. (markt)         + Fix: Fix various instances of double decoding of URL patterns configured           either programmatically or in web.xml. (remm/markt)         + Fix: Align the rewrite conditions ornext flag processing with mod_rewrite,           which follows a purely sequential evaluation strategy. (remm)         + Fix: Change the default for the useRedirect attribute of the           ProxyErrorReportValve from true to false. (markt)         + Add: Add support for the showReport attribute in JsonErrorReportValve and           ProxyErrorReportValve. When set to false, detailed error information           (message, description, stack trace) is suppressed from error responses.
          (dsoumis)         + Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar is           removed but catalina-ha.jar is present and the Cluster element is enabled           in server.xml. Cluster digester rules are now fully conditional on both           JARs being available. (dsoumis)         + Fix: Fix a potential deadlock when copying resources using WebDAV. (markt)         + Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list           of reserved prefixes for SSI variables and request attributes. (markt)         + Fix: Missing URL decoding when processing addMapping on a Servlet           registration. (remm)         + Fix: The Timeout WebDAV header allows comma separated values (according to           the examples in the RFC). Use the first acceptable value. (remm)         + Fix: Fix various issues when logging the effective web.xml for a web           application. Empty sections are no longer logged. Special roles and empty           authorisation constraints are included. (markt)         + Fix: Expand the write lock for the save process in the MemoryUserDatabase           to avoid concurrency issues with the file save operations. (markt)         + Fix: Ensure atomic session persistence in FileStore. Based on pull request           #1016 by sahvx655-wq. (markt)         + Fix: Do not ignore methods configured on security constraints that map to           the default servlet. (markt)
      * Cluster         + Fix: Expand wording and increase visibility of log message when cloud           membership is configured without a trust store as all certificates will be           trusted in this configuration. (markt)         + Fix: Ensure listeners are correctly added and removed when configuring the           channel coordinator. (markt)         + Fix: Fix some concurrency issues in FragmentationInterceptor. (markt)         + Fix: Fix some concurrency issues in OrderInterceptor. (markt)         + Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt)         + Fix: Fix concurrency issues generating MD5 digests in the           CloudMembershipProvider implementations. (markt)         + Add: Add replay protection to the EncryptInterceptor. This is a breaking           change for the EncryptInterceptor. (markt)
      * Coyote         + Add: Log a suitable warning if an encrypted PEM file is detected using an           insecure form for encryption. (markt)         + Fix: If TLS groups have been configured, use the configured groups rather           than using OpenSSL's default TLS groups when using Tomcat Native with           OpenSSL based connectors. (markt)         + Fix: For HTTP/2, ensure that any in progress request body reads are           cancelled if the container resets the associated stream. This prevents           delays waiting for reads to time out when it is known that no more data           will be received. (markt)         + Fix: Ensure that malformed HTTP/2 messages that should trigger a stream           reset do so, rather than triggered a connection close. (markt)         + Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm)         + Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2,           following refactor clean-up of header buffer. (remm)         + Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm)         + Fix: Fix MessageByte.equals if called on a null MB. (remm)         + Fix: Call the delegate key manager in JSSE to retrieve the server key.
          (remm)         + Fix: Avoid overflow scenarios in Asn1Parser. (remm)         + Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that           allows the consistency check for the scheme provided by the user agent to           be bypassed. (markt)         + Fix: isTrailerFieldsReady was always returning true. (remm)         + Fix: Align OpenSSL/Panama TLS implementation with other implementations           and throw an exception if there is an error loading the provided CRL(s).
          (markt)         + Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if           @STRENGTH was encountered, ignoring any subsequent expressions. (markt)         + Fix: Handle the case where the HTTP/2 payload length is insufficient for           the mandatory data required by the flags set in the header. (markt)         + Fix: 70102: Correct expected size of ticket keys when calling           setSessionTicketKeys with an FFM connector. (markt)         + Fix: 69988: Fix post handshake authentication for TLS 1.3. It was broken           by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt)         + Fix: When processing an OpenSSL cipher specification, fully align the           order of the resulting ciphers with the order produced by OpenSSL. (markt)         + Add: Add support for Brainpool TLS groups. Patch provided by YStankov.
          (schultz)         + Update: Update both the minimum and recommended version for Tomcat Native           1.x to 1.3.8. (markt)
      * Jasper         + Fix: Fix possible EL argument mismatch when it was set to null. (remm)         + Fix: Fix thread safety of TagPluginManager. (remm)         + Fix: Correctly use flush on JSP include. (remm)
      * Web applications         + Add: Manager: Add checks to ensure that any uploaded files are uploaded to           the expected location. (markt)         + Add: Manager: Add checks to ensure that the requested context path for a           deployed WAR, directory or descriptor file is valid. (markt)         + Add: Documentation: Expand the description of some of the attributes of           the CrawlerSessionManagerValve. (markt)         + Fix: Documentation: Clearer description and correct documented default for           ocspSoftFail. (markt)         + Fix: Fix double escaping in the context names for the JSON mode of the           manager servlet. (remm)         + Fix: Manager: Ensure automatic deployment does not trigger an undeployment           during a Manager triggered web application reload. (markt)         + Fix: Documentation: Provide better documentation for the scheme and secure           attributes of a Connector. (markt)
      * Websocket         + Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm)         + Fix: Trigger standard WebSocket error handling if a call to           Endpoint.onOpen() fails for a programmatic endpoint. (markt)         + Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a           programmatic endpoint. Test case provided by uabdur. (markt)         + Fix: If a client presents invalid parameters when negotiating a WebSocket           extension, decline the negotiation offer that includes the invalid           parameters rather than failing the connection. Pull request #1019 provided           by sahvx655-wq. (markt)
      * Other         + Fix: Wrong references to jakarta instead of javax. (remm)         + Fix: Restore default authenticator to nullafter executing an Ant task.
          (remm)         + Update: Update Commons Daemon to 1.6.1. (markt)         + Update: Improvements to French translations. (remm)         + Update: Improvements to Japanese translations provided by tak7iji. (markt)         + Update: Update Tomcat Native to 1.3.8. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 9.0.0-M1 prior to 9.0.119, 10.1.0-M1 prior to 10.1.56 or 11.0.0-M1 prior to 11.0.23. It is, therefore, affected by multiple vulnerabilities :

 - If security constraints were specified for the default servlet, any method or method omission configured as part of the constraint was ignored. (CVE-2026-55956)

 - Contrary to the documentation, the EncryptInterceptor was not protected against replay attacks. (CVE-2026-55955)

 - Logic errors in the effective web.xml generation meant that neither special roles nor empty authorization constraints were included in the logged effective web.xml. (CVE-2026-55276)

 - If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted. (CVE-2026-53434)

 - If a request matched the first condition in an OR chain in the RewriteValve, subsequent non-OR conditions were skipped and the rewrite succeeded. (CVE-2026-53404)

 - The use of wildcard property mapping resulted in some properties that were intended to be internal only being exposed to clients, allowing an XSS attack. (CVE-2026-50229)

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number     guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from     10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through     7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to     upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue. (CVE-2026-50229)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tomcat installed on the remote host is prior to 9.0.119. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.119_security-9 advisory.

  - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and     empty authorisation constraints were not included when the effective web.xml was logged. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1     through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be     affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
    (CVE-2026-55276)

  - Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the     default servlet ignoring any method or method omission configured as part of the constraint. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1     through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached     end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or     9.0.119, which fix the issue. (CVE-2026-55956)

  - Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the     EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from     7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which     fixes the issue. (CVE-2026-55955)

  - Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM     based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through     10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or     9.0.119, which fixes the issue. (CVE-2026-53434)

  - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if     the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through     9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-53404)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 11.0.23. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.23_security-11 advisory.

  - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and     empty authorisation constraints were not included when the effective web.xml was logged. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1     through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be     affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
    (CVE-2026-55276)

  - Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the     default servlet ignoring any method or method omission configured as part of the constraint. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1     through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached     end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or     9.0.119, which fix the issue. (CVE-2026-55956)

  - Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the     EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from     7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which     fixes the issue. (CVE-2026-55955)

  - Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM     based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through     10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or     9.0.119, which fixes the issue. (CVE-2026-53434)

  - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if     the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through     9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-53404)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.56. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.56_security-10 advisory.

  - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and     empty authorisation constraints were not included when the effective web.xml was logged. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1     through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be     affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
    (CVE-2026-55276)

  - Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the     default servlet ignoring any method or method omission configured as part of the constraint. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1     through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached     end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or     9.0.119, which fix the issue. (CVE-2026-55956)

  - Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the     EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from     7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which     fixes the issue. (CVE-2026-55955)

  - Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM     based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through     10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or     9.0.119, which fixes the issue. (CVE-2026-53434)

  - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if     the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through     9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
    Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
    (CVE-2026-53404)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
327757	SUSE SLES15: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (SUSE-SU-2026:3087-1)	Nessus	SuSE Local Security Checks	critical
327756	SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / etc (SUSE-SU-2026:3088-1)	Nessus	SuSE Local Security Checks	critical
327729	SUSE SLES15: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (SUSE-SU-2026:3112-1)	Nessus	SuSE Local Security Checks	critical
327623	SUSE SLES16: tomcat10 / tomcat10-admin-webapps / tomcat10-doc / etc (SUSE-SU-2026:22647-1)	Nessus	SuSE Local Security Checks	critical
327622	SUSE SLES16: tomcat11 / tomcat11-admin-webapps / tomcat11-doc / etc (SUSE-SU-2026:22648-1)	Nessus	SuSE Local Security Checks	critical
327591	SUSE SLES16: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2026:22646-1)	Nessus	SuSE Local Security Checks	critical
327338	Ubuntu 16.04 LTS / 18.04 LTS : Tomcat vulnerabilities (USN-8551-1)	Nessus	Ubuntu Local Security Checks	critical
327245	openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21328-1)	Nessus	SuSE Local Security Checks	critical
327236	openSUSE 16: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (openSUSE-SU-2026:21329-1)	Nessus	SuSE Local Security Checks	critical
327229	openSUSE 16: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / tomcat-embed / etc (openSUSE-SU-2026:21327-1)	Nessus	SuSE Local Security Checks	critical
115283	Apache Tomcat 9.0.0-M1 < 9.0.119 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115282	Apache Tomcat 10.1.0-M1 < 10.1.56 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115281	Apache Tomcat 11.0.0-M1 < 11.0.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
323925	Linux Distros Unpatched Vulnerability : CVE-2026-50229	Nessus	Misc.	medium
323714	Apache Tomcat 9.0.0.M1 < 9.0.119 multiple vulnerabilities	Nessus	Web Servers	critical
323713	Apache Tomcat 11.0.0.M1 < 11.0.23 multiple vulnerabilities	Nessus	Web Servers	critical
323712	Apache Tomcat 10.1.0.M1 < 10.1.56 multiple vulnerabilities	Nessus	Web Servers	critical

Detections

Analytics

CVE-2026-50229

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

critical