Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on     timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19     through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are recommended to     upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue. (CVE-2026-78437)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tomcat installed on the remote host is prior to 9.0.122. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.122_security-9 advisory.

  - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from     10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26,     10.1.60 or 9.0.122, which fix the issue. (CVE-2026-86248)

  - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be     affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

  - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following     versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through     8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.59, 9.0.122, which fixes the issue. (CVE-2026-73581)

  - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications. This     issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are     recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue. (CVE-2026-75973)

  - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at     the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through     7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.60 or 9.0.122, which fix the issue. (CVE-2026-76183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 11.0.26. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.26_security-11 advisory.

  - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from     10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26,     10.1.60 or 9.0.122, which fix the issue. (CVE-2026-86248)

  - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be     affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

  - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following     versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through     8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.59, 9.0.122, which fixes the issue. (CVE-2026-73581)

  - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications. This     issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are     recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue. (CVE-2026-75973)

  - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at     the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through     7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.60 or 9.0.122, which fix the issue. (CVE-2026-76183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.60. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.60_security-10 advisory.

  - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from     10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26,     10.1.60 or 9.0.122, which fix the issue. (CVE-2026-86248)

  - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be     affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

  - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following     versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through     8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.59, 9.0.122, which fixes the issue. (CVE-2026-73581)

  - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications. This     issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are     recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue. (CVE-2026-75973)

  - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at     the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through     7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.60 or 9.0.122, which fix the issue. (CVE-2026-76183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
349598	Linux Distros Unpatched Vulnerability : CVE-2026-78437	Nessus	Misc.	Local	high
349472	Apache Tomcat 9.0.0.M1 < 9.0.122 multiple vulnerabilities	Nessus	Web Servers	Combined	critical
349471	Apache Tomcat 11.0.0.M1 < 11.0.26 multiple vulnerabilities	Nessus	Web Servers	Combined	critical
349470	Apache Tomcat 10.1.0.M1 < 10.1.60 multiple vulnerabilities	Nessus	Web Servers	Combined	critical

Detections

Analytics

CVE-2026-78437

high

Tenable Plugins

high

critical

critical

critical