Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5116-1 advisory.

    - CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure (bsc#1286502).
    - CVE-2026-74049: Jasper JSTL <c:redirect> plug-in implementation omits page abort (bsc#1286555).
    - CVE-2026-80353: TOCTOU when creating unix domain sockets for the APR/Native connector allows an     unauthorized local       user to access the unix domain socket (bsc#1286902).
    - CVE-2026-88041: Information disclosure via incomplete HTTP trailer cleanup (bsc#1286559).
    - CVE-2026-93446: Possible TLS 1.3 connection failures (bsc#1286571).
    - CVE-2026-101296: Authentication bypass via non-GSSAPI SASL in JNDI realm (bsc#1286361).
    - CVE-2026-101356: Information disclosure via incorrect object recycling in HTTP/2 processing     (bsc#1286362).

    Changes for tomcat:

    Update to Tomcat 9.0.123:

      * Catalina
        - Fix: When starting a web application, don't try and use the web           application class loader until after the web application class loader           has started. (markt)
        - Fix: various concurrency issues around adding and removing Realms from a           CombinedRealm, in particular doing so while the CombinedRealm is in use.
          Note that once a Realm instance has been removed from a CombinedRealm           instance at run-time, the removed Realm instance may not be reused apart           from re-adding it to the same CombinedRealm. (markt)
        - Update: When StoreConfig re-writes an existing server.xml or context           configuration file, preserve the layout of the existing file (comments,           blank lines and attribute order) on a best effort basis. (remm)
        - Fix: Track in StandardContext whether the context was deployed from a           Context element in server.xml. Use it to have StoreConfig save to a new           config file. (remm)
        - Fix: Improve error handling on start-up. (markt)
        - Fix: byte range responses generated by DefaultServlet so a short           resource stream read does not truncate the response. Treat a premature           end of stream as an I/O error. Based on pull request #1067 by aoto-tech.
          (markt)
        - Fix: Align OpenSSLLifecycleListener with AprLifecycleListener and throw           an Error when FIPS is requested but not available. (markt)
        - Fix: Ensure that, as per the documentation, a simple bind is always used           when the JNDI realm binds using the user provided name and password to           authenticate the user. (markt)
        - Update: Optimize Accept-Language header processing and use of resource           budles for localization. (remm)
      * Coyote
        - Fix: 70236: Fix a stalled TLS handshake with the OpenSSL based           implementations of SSLEngine when the first flight of handshake messages           sent by the server is too large to fit in the buffer used by the BIO           pair. Patch submitted by Lukas Hellebrandt. (remm)
        - Fix: #1073: Fix possible corruption when using HTTP/2 and async IO on           uploads. Submitted by Tim Burke. (remm)
        - Fix: Avoid very rare race between async write notification and           completion. Skip the write notification in these cases since it would be           useless. (remm)
        - Fix: a timing issue that could cause large non-blocking writes to stall           for AJP connections. (markt)
        - Fix: Ensure that the non-blocking write buffer is empty before sending           an AJP end response message. (markt)
        - Fix: CharChunk.indexOf(char) so that it searches from the start of the           chunk rather than from twice the chunk's start offset when the chunk           does not begin at the start of its buffer. (breken-ai)
        - Fix: 70247: Fix a leak in the HTTP/2 connection flow control window when           part of the HTTP request body is received but not read. Based on a patch           provided by Guillaume Darmont. (markt)
        - Fix: 70251: Avoid closing a JarFile in CloseableURLConnection unless it           is certain the JAR is not shared. (remm)
        - Fix: possible corruption of HTTP/1.1 chunked response bodies if a           previous write to a chunked body fails. (markt)
        - Fix: Align cipher order with the results produced by OpenSSL if the           cipher specification adds, removes and then re-adds ciphers. (markt)
        - Add: new attributes (unixDomainSocketParentPermissions and           unixDomainSocketParentOwner) to the APR/Native connector to provide           additional control over the security of Unix Domain Sockets. Additional           checks (enabled by default) have also been added for the directory where           the Unix Domain Socket will be created.(markt)
        - Fix: Correct a narrow race condition when processing HTTP/2 headers.
          (markt)
        - Fix: possible TLS connections failures caused by one of the flags Tomcat           uses to track TLS handshake progress not being correctly reset. (markt)
        - Fix: Allow for absolute host names in SNI checks. (markt)
        - Fix: Correct a gap in asynchronous error handling that could lead to           unexpected IllegalStateExceptions for some error conditions. (markt)         + Add: Harden HTTP/2 against applications that do not correctly handle           asynchronous errors. (markt)
      * Jasper         + Fix: Route JspC servlet context logging through Ant when used as an Ant           task. (sainadh777)         + Fix: the tag plugin for the JSTL c:redirtect tag so that page           processing ends with the redirect. (markt)
      * Web applications         + Add: Documentation: Explicitly state that virtual host matching via the           HTTP host header and TLS configuration matching via SNI are completely           separate processes. (markt)         + Fix: Examples: Draw axis-aligned rectangles and ellipses as lines in the           WebSocket drawboard. (sainadh777)
      * Other         + Update: the internal fork of Apache Commons BCEL to 6.13.0. (markt)         + Update: to NSIS 3.13. (markt)         + Update: to Byte Buddy 1.18.14. (markt)         + Update: to Bouncy Castle 1.8.6. (markt)         + Add: Improvements to French translations. (remm)         + Add: Improvements to Japanese translations provided by tak7iji. (markt)
      * Cluster         + Fix: Replicate SSO session key set changes made by removeSession() and           sessionChangedId() in ClusterSingleSignOn so that SSO entries are           correctly deregistered and removed from all nodes when the last           associated session expires, even when the sessions expire on different           cluster nodes. (remm)         + Fix: Move context attributes that were set while the web application was           still starting into the replicated attribute map when it is installed in           ReplicatedContext, so that they are replicated to the other nodes like           attributes set later on rather than remaining local to the node that           started the application. (remm)         + Fix: a possible deadlock in DeltaSession.expire(): the final session           delta is now captured and sent to the cluster before the session monitor           is acquired, because obtaining the delta takes the delta lock and code           that runs while the delta lock is held, such as session attribute           listener notifications, may in turn wait for the session monitor. (remm)         + Fix: Fire the documented send_message_failure lifecycle event with the           message, destination and exception when a SimpleTcpCluster message send           fails and notifyLifecycleListenerOnFailure is enabled. The event was           previously declared but never fired. (remm)         + Fix: a possible deadlock in DeltaSession: session attribute listeners           are no longer called while the delta lock is held when attributes are           set or removed. The delta lock is only held while the change is           recorded. (markt)         + Fix: a possible deadlock in DeltaSession: received session deltas are           now read into a separate DeltaRequest from the one the session uses to           record local changes. This avoids having to hold the delta lock while           processing received changes. (markt)         + Fix: Move context attributes that were set while the web application was           still starting into the replicated attribute map when it is installed in           ReplicatedContext, so that they are replicated to the other nodes like           attributes set later on rather than remaining local to the node that           started the application. (remm)         + Fix: an issue replicating SessionListener additions and removals that           meant some modification were not replicated leading to inconsistent           listener configurations across the cluster. (markt)
      * Tribes         + Docs: Document Tribes channel, membership, transport and replication           status available through JMX. Based on pull request #1071 by sainadh777.
          (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5073-1 advisory.

    - CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure (bsc#1286502).
    - CVE-2026-74049: Jasper JSTL <c:redirect> plug-in implementation omits page abort (bsc#1286555).
    - CVE-2026-88041: Information disclosure via incomplete HTTP trailer cleanup (bsc#1286559).
    - CVE-2026-93446: Possible TLS 1.3 connection failures (bsc#1286571).
    - CVE-2026-101296: Authentication bypass via non-GSSAPI SASL in JNDI realm (bsc#1286361).
    - CVE-2026-101356: Information disclosure via incorrect object recycling in HTTP/2 processing     (bsc#1286362).

    Changes:

    Update to Tomcat 10.1.61:

     * Catalina      + Fix: When starting a web application, don't try and use the web      application class loader until after the web application class loader      has started. (markt)      + Fix: various concurrency issues around adding and removing Realms from a      CombinedRealm, in particular doing so while the CombinedRealm is in use.
     Note that once a Realm instance has been removed from a CombinedRealm      instance at run-time, the removed Realm instance may not be reused apart      from re-adding it to the same CombinedRealm. (markt)      + Update: When StoreConfig re-writes an existing server.xml or context      configuration file, preserve the layout of the existing file (comments,      blank lines and attribute order) on a best effort basis. (remm)      + Fix: Track in StandardContext whether the context was deployed from a      Context element in server.xml. Use it to have StoreConfig save to a new      config file. (remm)      + Fix: Improve error handling on start-up. (markt)      + Fix: byte range responses generated by DefaultServlet so a short      resource stream read does not truncate the response. Treat a premature      end of stream as an I/O error. Based on pull request #1067 by aoto-tech.
     (markt)      + Fix: Align OpenSSLLifecycleListener with AprLifecycleListener and throw      an Error when FIPS is requested but not available. (markt)      + Fix: Ensure that, as per the documentation, a simple bind is always used      when the JNDI realm binds using the user provided name and password to      authenticate the user. (markt)      + Update: Optimize Accept-Language header processing and use of resource      budles for localization. (remm)
     * Coyote      + Fix: 70236: Fix a stalled TLS handshake with the OpenSSL based      implementations of SSLEngine when the first flight of handshake messages      sent by the server is too large to fit in the buffer used by the BIO      pair. Patch submitted by Lukas Hellebrandt. (remm)      + Fix: #1073: Fix possible corruption when using HTTP/2 and async IO on      uploads. Submitted by Tim Burke. (remm)      + Fix: Avoid very rare race between async write notification and      completion. Skip the write notification in these cases since it would be      useless. (remm)      + Fix: a timing issue that could cause large non-blocking writes to stall      for AJP connections. (markt)      + Fix: Ensure that the non-blocking write buffer is empty before sending      an AJP end response message. (markt)      + Fix: CharChunk.indexOf(char) so that it searches from the start of the      chunk rather than from twice the chunk's start offset when the chunk      does not begin at the start of its buffer. (breken-ai)      + Fix: 70247: Fix a leak in the HTTP/2 connection flow control window when      part of the HTTP request body is received but not read. Based on a patch      provided by Guillaume Darmont. (markt)      + Fix: 70251: Avoid closing a JarFile in CloseableURLConnection unless it      is certain the JAR is not shared. (remm)      + Fix: possible corruption of HTTP/1.1 chunked response bodies if a      previous write to a chunked body fails. (markt)      + Fix: Align cipher order with the results produced by OpenSSL if the      cipher specification adds, removes and then re-adds ciphers. (markt)      + Fix: Correct a narrow race condition when processing HTTP/2 headers.
     + Fix: possible TLS connections failures caused by one of the flags Tomcat      uses to track TLS handshake progress not being correctly reset. (markt)      + Fix: Allow for absolute host names in SNI checks. (markt)      + Fix: Correct a gap in asynchronous error handling that could lead to      unexpected IllegalStateExceptions for some error conditions. (markt)      + Add: Harden HTTP/2 against applications that do not correctly handle      asynchronous errors. (markt)
     * Jasper      + Fix: Route JspC servlet context logging through Ant when used as an Ant      task. (sainadh777)      + Fix: the tag plugin for the JSTL <c:redirtect> tag so that page      processing ends with the redirect. (markt)
     * Web applications      + Add: Documentation: Explicitly state that virtual host matching via the      HTTP host header and TLS configuration matching via SNI are completely      separate processes. (markt)      + Fix: Examples: Draw axis-aligned rectangles and ellipses as lines in the      WebSocket drawboard. (sainadh777)
     * Other      + Update: the internal fork of Apache Commons BCEL to 6.13.0. (markt)      + Update: to NSIS 3.13. (markt)      + Update: to Byte Buddy 1.18.14. (markt)      + Update: to Bouncy Castle 1.8.6. (markt)      + Add: Improvements to French translations. (remm)      + Add: Improvements to Japanese translations provided by tak7iji. (markt)      + Update: to Migration tool for Jakarta EE 1.0.13. (markt)
     * Cluster      + Fix: Replicate SSO session key set changes made by removeSession() and      sessionChangedId() in ClusterSingleSignOn so that SSO entries are      correctly deregistered and removed from all nodes when the last      associated session expires, even when the sessions expire on different      cluster nodes. (remm)      + Fix: Move context attributes that were set while the web application was      still starting into the replicated attribute map when it is installed in      ReplicatedContext, so that they are replicated to the other nodes like      attributes set later on rather than remaining local to the node that      started the application. (remm)      + Fix: a possible deadlock in DeltaSession.expire(): the final session      delta is now captured and sent to the cluster before the session monitor      is acquired, because obtaining the delta takes the delta lock and code      that runs while the delta lock is held, such as session attribute      listener notifications, may in turn wait for the session monitor. (remm)      + Fix: Fire the documented send_message_failure lifecycle event with the      message, destination and exception when a SimpleTcpCluster message send      fails and notifyLifecycleListenerOnFailure is enabled. The event was      previously declared but never fired. (remm)      + Fix: a possible deadlock in DeltaSession: session attribute listeners      are no longer called while the delta lock is held when attributes are      set or removed. The delta lock is only held while the change is      recorded. (markt)      + Fix: a possible deadlock in DeltaSession: received session deltas are      now read into a separate DeltaRequest from the one the session uses to      record local changes. This avoids having to hold the delta lock while      processing received changes. (markt)      + Fix: an issue replicating SessionListener additions and removals that      meant some modification were not replicated leading to inconsistent      listener configurations across the cluster. (markt)
     * Tribes      + Docs: Document Tribes channel, membership, transport and replication      status available through JMX. Based on pull request #1071 by sainadh777.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is     configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in     non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through     11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to     version 11.0.27, 10.1.61 or 9.0.123, which fix the issue. (CVE-2026-74048)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Apache Tomcat installed on the remote host is 9.0.0-M1 prior to 9.0.123, 10.1.0-M1 prior to 10.1.61 or 11.0.0-M1 prior to 11.0.27. It is, therefore, affected by multiple vulnerabilities :

- A buffer under-read in the AJP connector meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection, possibly leaking data from the first response to the second (11.0.x only). (CVE-2026-103119)

- Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. (CVE-2026-101356)

- When the JNDI realm was configured with a non-GSSAPI SASL authentication mechanism, attackers could authenticate without providing the correct password. (CVE-2026-101296)

- An incomplete cleanup vulnerability could cause TLS 1.3 connections to fail intermittently. (CVE-2026-93446)

- An incomplete cleanup vulnerability allowed HTTP/2 trailer information from a previous request to leak into a subsequent request. (CVE-2026-88041)

- A race condition when creating a Unix Domain Socket with the APR connector allowed an unauthorised local user to access the Unix Domain Socket, due to an incomplete fix for CVE-2026-65183 (9.0.x only). (CVE-2026-80353)

- The Jasper JSTL plug-in replacement for <c:redirect> does not immediately end processing, allowing the rest of the page to be processed despite the redirect. (CVE-2026-74049)

- If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs an error but continues to use JSSE in non-FIPS mode with the provided configuration. (CVE-2026-74048)

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
376964	SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / etc (SUSE-SU-2026:5116-1)	Nessus	SuSE Local Security Checks	Local	critical
376264	SUSE SLES15: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (SUSE-SU-2026:5073-1)	Nessus	SuSE Local Security Checks	Local	critical
374094	SUSE SLES12: libapr1 / libapr1-devel / libtcnative-1-0 / libtcnative-1-0-devel / etc (SUSE-SU-2026:4927-1)	Nessus	SuSE Local Security Checks	Local	critical
369010	Linux Distros Unpatched Vulnerability : CVE-2026-74048	Nessus	Misc.	Local	medium
115718	Apache Tomcat 9.0.0-M1 < 9.0.123 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115717	Apache Tomcat 10.1.0-M1 < 10.1.61 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115716	Apache Tomcat 11.0.0-M1 < 11.0.27 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical

Detections

Analytics

CVE-2026-74048

medium

Tenable Plugins

critical

critical

critical

medium

critical

critical

critical