Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3166 advisory.

    Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from     9.0.0-M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.
    (CVE-2026-73581)

    Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M4 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.
    (CVE-2026-75973)

    Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.



    The following versions were EOS at the time the CVE was created but areknown to be affected: from 8.5.0     through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-76183)

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache     Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to     cause one request from another user to fail when Tomcat is located behind a reverse proxy.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.47 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-77756)

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability     in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.39 through 9.0.121.

    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.59     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.
    (CVE-2026-77762)

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message     enabled a DoS attack.

    This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74     through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.88     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-77791)

    Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

    Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on     timing) cause one request from another user to fail.

    This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116     through 9.0.121.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78437)

    Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in     Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-79677)

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat.



    This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from     9.0.92 through 9.0.121.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-86248)

    Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache     Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.



    This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118     through 9.0.121.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-86350)

    Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket     message smuggling when per-message-deflate is used.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue.
    (CVE-2026-87022)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tomcat installed on the remote host is prior to 9.0.122-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2026-029 advisory.

    Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from     9.0.0-M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.
    (CVE-2026-73581)

    Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M4 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.
    (CVE-2026-75973)

    Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.



    The following versions were EOS at the time the CVE was created but areknown to be affected: from 8.5.0     through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-76183)

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache     Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to     cause one request from another user to fail when Tomcat is located behind a reverse proxy.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.47 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-77756)

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability     in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.39 through 9.0.121.

    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.59     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.
    (CVE-2026-77762)

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message     enabled a DoS attack.

    This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74     through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.88     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-77791)

    Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

    Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on     timing) cause one request from another user to fail.

    This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116     through 9.0.121.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78437)

    Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in     Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-79677)

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat.



    This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from     9.0.92 through 9.0.121.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-86248)

    Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache     Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.



    This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118     through 9.0.121.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-86350)

    Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket     message smuggling when per-message-deflate is used.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue.
    (CVE-2026-87022)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3151 advisory.

    Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security     constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for     a shorter sub-path.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from     9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.



    Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
    (CVE-2026-65182)

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain     sockets allows an unauthorised local user to access the unix domain socket.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from     9.0.42 through 9.0.120.



    Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
    (CVE-2026-65183)

    Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.



    This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115     through 9.0.120.



    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-65637)

    Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before     windowSize requests have been made, a client makes a DIGESTauthenticated request with a nonceCount on the     upper boundary of thereplay window then that request is replayable once only while theassociated     nonceCount remains within the replay window.





    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from     9.0.0.M1 through 9.0.120.



    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.0     through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-65905)

    Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes     rewrite processing to restart at the second rule rather than the first rule.







    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from     9.0.0.M1 through 9.0.120.



    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.0     through 8.5.100. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.
    (CVE-2026-65927)

    Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being     incorrectly used as role aliases within the Realm in additional to the correct usage with     Request.isUserInRole().



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from     9.0.25 through 9.0.120.



    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.46     through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-66422)

    Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing     of a security constraint that limits user has access to a resource POST but not GET.







    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from     9.0.0.M1 through 9.0.120.







    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.0     through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.















    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.
    (CVE-2026-68525)

    Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT,     SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from     9.0.0.M1 through 9.0.120.







    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.0     through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.







    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-68569)

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2     backlog tracking when a stream is reset



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from     9.0.39 through 9.0.120.



    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.59     through 8.5.100. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-68763)

    Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an     authenticated HTTP session was changed after a WebSocket connection had been established under that     authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket     specification when the HTTP session ended.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from     9.0.0.M1 through 9.0.120.



    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.0     through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-73180)

    Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from     9.0.0-M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.
    (CVE-2026-73581)

    Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M4 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.
    (CVE-2026-75973)

    Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.



    The following versions were EOS at the time the CVE was created but areknown to be affected: from 8.5.0     through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-76183)

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache     Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to     cause one request from another user to fail when Tomcat is located behind a reverse proxy.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.47 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-77756)

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability     in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.39 through 9.0.121.

    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.59     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.
    (CVE-2026-77762)

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message     enabled a DoS attack.

    This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74     through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.88     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-77791)

    Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

    Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on     timing) cause one request from another user to fail.

    This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116     through 9.0.121.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78437)

    Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in     Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-79677)

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat.



    This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from     9.0.92 through 9.0.121.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-86248)

    Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache     Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.



    This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118     through 9.0.121.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-86350)

    Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket     message smuggling when per-message-deflate is used.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue.
    (CVE-2026-87022)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3165 advisory.

    Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from     9.0.0-M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.
    (CVE-2026-73581)

    Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M4 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.
    (CVE-2026-75973)

    Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed.



    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.



    The following versions were EOS at the time the CVE was created but areknown to be affected: from 8.5.0     through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-76183)

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache     Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to     cause one request from another user to fail when Tomcat is located behind a reverse proxy.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.47 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-77756)

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability     in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.39 through 9.0.121.

    The following versions were EOL at the time the CVE was created but areknown to be affected: from 8.5.59     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.
    (CVE-2026-77762)

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message     enabled a DoS attack.

    This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74     through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.88     through 8.5.100. Other unsupported versions may also be affected.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-77791)

    Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

    Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on     timing) cause one request from another user to fail.

    This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116     through 9.0.121.

    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78437)

    Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in     Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-79677)

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat.



    This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from     9.0.92 through 9.0.121.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-86248)

    Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache     Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.



    This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118     through 9.0.121.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-86350)

    Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket     message smuggling when per-message-deflate is used.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from     9.0.0.M1 through 9.0.121.

    The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0     through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected.



    Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue.
    (CVE-2026-87022)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4546-1 advisory.

    Security issues fixed:

    libtcnative-1-0:

    - CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a     JVM crash       (bsc#1282623).
    - CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF     and       ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622).
    - CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for     some       configurations (bsc#1282621).

    tomcat,tomcat10:

    - CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore       (bsc#1282631).
    - CVE-2026-75973: improper authentication when Jakarta authentication is configured with     `SimpleAuthConfigProvider`       (bsc#1282630).
    - CVE-2026-76183: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629).
    - CVE-2026-77756: inconsistent interpretation of HTTP requests allows an attacker to cause one request     from another user       to fail when Tomcat is located behind a reverse proxy (bsc#1282628).
    - CVE-2026-77762: stale HPACK emitter injects trailers fields into another HTTP/2 request (bsc#1282599).
    - CVE-2026-77791: uncontrolled resource consumption when sending WebSocket close message enabled a DoS     attack       (bsc#1282627).
    - CVE-2026-78383: allocation of resources without limits or throttling allows an unauthenticated AJP     request to pin an       AJP processing thread leading to denial of service (bsc#1282626).
    - CVE-2026-78437: incomplete cleanup allows a malformed request to potentially cause requests from another     user to fail       (bsc#1282625).
    - CVE-2026-79677: missing release of resource after effective lifetime and comparison using wrong factors     allows for       denial of service due to lost time outs for asynchronous WebSocket writes (bsc#1282624).
    - CVE-2026-86248: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail     is disabled       (bsc#1282620).
    - CVE-2026-86350: HTTP/2 requests can cause request header mix-ups and HTTP request smuggling     (bsc#1282787).
    - CVE-2026-87022: WebSocket message smuggling when per-message-deflate is used (bsc#1282581).

    Changes for libtcnative-1-0:

    - Update to 1.3.9
     * Security fixes      + Client certificate requirements can be down-graded      (bsc#1282621, CVE-2026-86247)      A race condition allowed client certificate verification      requirements to be down-graded for some configurations.
     + Insecure OpenSSL options enabled (bsc#1282622, CVE-2026-86246)      Apache Tomcat Native enabled insecure options by default      including ALLOW_CLIENT_RENEGOTIATION,      NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and      ALLOW_NO_DHE_KEX.
     + DoS via TLS handshake (bsc#1282623, CVE-2026-86243)      A buffer over-read vulnerability in Apache Tomcat Native      during the TLS handshaking permits a malicious user to trigger      a DoS via a JVM crash.
     * Changes      + Code: Remove call to ERR_remove_thread_state() from Windows      specific code to allow building with OpenSSL 4.0.x.
     ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got      removed in OpenSSL 4      + Fix: Fix a potential crash when negotiating ALPN      + If ALPN negotiation fails and failure is configured to use      the last server protocol in the list, use it rather than the      last protocol offered by the client      + Fix: Add support for the extended range of options available      from OpenSSL 3.0.x. The options flag is now a 64-bit unsigned      int (represented by a Java long) rather than a 32-bit unsigned      int (represented by a Java int)      + Code: Remove unused code      + Ensure that per connection changes to certificate verification      settings, e.g. to support client certificate authentication,      do not modify the certificate verification settings for other      connections      + Fix: Fix a potential crash when configuring raw certificates      + Fix: Avoid a potential crash with very long ALPN protocol      names      + Fix: Make the call to a CertificateVerifier more robust      + Fix: Avoid a potential crash when processing OCSP URLs      + Fix: Make the processing of OCSP responses more robust      + Fix: Stricter OCSP handling when soft-fail is disabled      + Fix: Harden against the mis-use of Buffer.address(ByteBuffer)      + Fix: Harden against the mis-use of Pool.destroy(long)      + Code: The minimum supported OpenSSL version is now 3.0.x.
     OpenSSL 1.1.1 support was accidentally broken in 1.3.8. As no      bug reports were receive for that failure and since both      Debian and Ubuntu versions that used OpenSSL 1.1.1 have      reached end of support, OpenSSL 1.1.1 is no longer supported      + Update: OpenSSL 3.0.x is approaching end of support so the      recommended version of OpenSSL (and the version that windows      binaries will be built with) now follows the 3.5.x LTS branch      + Fix: Switch to automatic configuration of DH parameters.
     Manual configuration attempts will be ignored      + Code: Make setTmpECDHByCurveName() a NO-OP      + Fix: Refactor extraction of ECDH curve name from the      Certificate to avoid deprecated OpenSSL methods      + Fix: Refactor the native implementation of SSL.getTime() to      avoid the Y2038 problem in SSL_SESSION_get_time() when running      on a verion of OpenSSL that includes the new      SSL_SESSION_get_time_ex() method

    Changes for tomcat:

    - Update to Tomcat 9.0.122
     * Catalina      + Fix: Improve the handling of AsyncContext.dispatch() when the Context      attribute dispatchersUseEncodedPaths is set to false since the      application has no control over the path used for the      AsyncContext.dispatch(). Prior to this fix, paths containing literal '?'      characters were truncated. (markt)      + Fix: Ensure that capture groups from a RewriteCond always reflect the      result of the current request. (markt)      + Fix: When a PersistentManager needs to reduce the number of active      sessions, swap out the least recently used eligible sessions first. Pull      request #1045 provided by sainadh777. (markt)      + Fix: Align web.xml logging output with the new Context attribute      urlPatternsProvidedInDecodedForm. (markt)      + Fix: Improve robustness of DIGEST authentication to system clock jumps.
     (markt)      + Add: Support multiple protocol header values (treat as a single merged      header value) in the RemoteIpFilter and RemoteIpValve. (markt)      + Fix: potential concurrency issues when loading/saving sessions from/to a      session store. Custom Store implementations that do not extend StoreBase      must implement the new getSessionStoreLock() method of the Store      interface to ensure concurrency protection. The default method      implementation provided only provides the pre-fix functionality. (markt)      + Fix: Ensure that PersistentManager implementations that extend      PersistentManagerBase do not swap out sessions that are associated with      a request that is currently being processed. As a result, it is now a      requirement that the system property      org.apache.catalina.session.StandardSession.ACTIVITY_CHECK is set to      true (either explicitly or via STRICT_SERVLET_COMPLIANCE) if either      minIdleSwap or maxIdleSwap are configured. (markt)
     * Coyote      + Fix: xreflection generated code stack overflow issue. (remm)      + Fix: Align xreflection better with IntrospectionUtils. (remm)      + Fix: In HTTP/2 after half closed (remote), any unexpected frame should      be a stream error. (remm)      + Fix: incorrect initial window size calculation when upgrading to HTTP/2.
     (remm)      + Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm)      + Fix: Only try and load the native library from the CATALINA_HOME system      property when the property is set. (markt)      + Fix: max connections enforcement after an enpoint resume. (remm)      + Fix: Implement stricter ALPN matching for Connectors using FFM. (markt)      + Add: length validation for ALPN protocol names. (markt)      + Fix: Make FFM certificate verification more robust. (markt)      + Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing      failure as if no usable OCSP URLs were present. (markt)      + Fix: Make the processing of OCSP responses more robust. (markt)      + Fix: Stricter OCSP handling when soft-fail is disabled. (markt)      + Fix: Cleaner handling of AJP response headers which overflow the maximum      message size. (remm)      + Fix: Small per performance optimisation. Don't waste cycles swallowing      an AJP response body when the connection is going to be closed. (markt)      + Fix: OpenSSL support for CRLs when using OpenSSL trust with the server      key held in a Java key store. (markt)      + Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding      header. (markt)      + Fix: Ensure per request HTTP/2 bad request marker is cleared when the      request is recycled. (markt)      + Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt)      + Fix: Revert earlier refactoring of HTTP/2 header field validation that      moved it earlier since the refactoring made correct handling of invalid      headers more difficult. (markt)
     * Jasper      + Fix: EL evaluation of some lambda expressions. (remm)
     * WebSocket      + Fix: an exception when an automatic Pong response races with the closing      of the WebSocket session. (moritzfl)      + Fix: Harden the WebSocket client and use a SecureRandom when generating      the Sec-WebSocket-Key header. (markt)      + Fix: Improve robustness of client handshakes. (remm)      + Fix: Ensure that WebSocket write timeouts apply to the complete message      and are not lost if two writes have the same timeout. (markt)      + Fix: Reduce CPU usage while sending WebSocket close message. (markt)      + Fix: overly broad check that prevented request URIs containing literal {      and } characters from being mapped to WebSocket end points. (markt)      + Fix: handling of WebSocket messages with compressed payloads using per-      message-deflate that have one or more non-final blocks where the BFINAL      bit is set. (markt)      + Fix: handling of per-message-deflate context takeover when receiving      compressed WebSocket messages. (markt)
     * Web applications      + Fix: Manager: Fix a potential concurrency issue when ordering sessions      prior to displaying a list of session. (markt)      + Docs: Wrap the RewriteRule regular expression syntax reference on narrow      displays. Pull request #1044 by sainadh777. (markt)
     * Other      + Update: Easymock to 5.7.0. (markt)      + Update: bnd to 7.4.0. (markt)      + Update: Tomcat Native to 1.3.9. (markt)      + Add: Improvements to French translations. (remm)      + Add: Improvements to Japanese translations provided by tak7iji and      Ktamura.biz.80. (markt)
     * Cluster      + Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a      positive integer. Zero or negative values previously caused an infinite      loop or a NegativeArraySizeException during session state transfer. Pull      request #1042 provided by lihongyi87. (markt)      + Fix: Improve robustness of cloud membership providers if an error occurs      fetching members. (remm)
     * jdbc-pool      + Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to      getConnection(String,String) rather than getConnection(). (markt)      + Add: Log a warning if an attempt is made to obtain a connection with      credentials when alternateUsernameAllowed is set to false. (markt)      + Fix: Ensure StatementCache interceptor resets properties of cached      statements between uses. (mark)

    Changes for tomcat10:

    - Update to Tomcat 10.1.60
     * Catalina      + Fix: When a PersistentManager needs to reduce the number of active      sessions, swap out the least recently used eligible sessions first. Pull      request #1045 provided by sainadh777. (markt)      + Fix: Align web.xml logging output with the new Context attribute      urlPatternsProvidedInDecodedForm. (markt)      + Fix: Improve robustness of DIGEST authentication to system clock jumps.
     (markt)      + Add: Support multiple protocol header values (treat as a single merged      header value) in the RemoteIpFilter and RemoteIpValve. (markt)      + Fix: potential concurrency issues when loading/saving sessions from/to a      session store. Custom Store implementations that do not extend StoreBase      must implement the new getSessionStoreLock() method of the Store      interface to ensure concurrency protection. The default method      implementation provided only provides the pre-fix functionality. (markt)      + Fix: Ensure that PersistentManager implementations that extend      PersistentManagerBase do not swap out sessions that are associated with      a request that is currently being processed. This includes not swapping      out a session unless the session was created when activity tracking was      enabled. (markt)      + Fix: Ensure namespace attributes are XML escaped in WebDAV responses.
     + Fix: Resolve null or missing rewrite substitutions as an empty string,      to align with the mod_rewrite behavior. (remm)      + Add: a best efforts protection in the CrawlerSessionManagerValve against      crawlers being associated with an authenticated session. (markt)      + Fix: Clarify the meaning of various RewriteValve server variables and      explicitly use the canonical context path for the CONTEXT_PATH server      variable. (markt)      + Fix: storeconfig not saving the path when a context is saved in      server.xml. (remm)      + Fix: WAR URLConnection should propagate use of caching. (remm)      + Fix: Ensure resources are evicted from the static resource cache in the      correct order. (markt)      + Fix: When Jakarta Authentication is configured for a web application,      cache the ServerAuthConfig in the Authenticator valve. This ensures web      application specific settings are cached on a per web application basis.
     + Fix: 70203: Fix RegistrationListener notifications in Jakarta      Authentication implementation. (markt)      + Fix: Handle CGI scripts that write excessively to stdout after setting      an HTTP error status code. (schultz)      + Fix: Require the request to the login action during FORM authentication      to be made using HTTP POST. (markt)      + Fix: 70208: Make URL encoding more robust. Based on pull request #1065      by Chenjp. (markt)
     * Coyote      + Fix: xreflection generated code stack overflow issue. (remm)      + Fix: Align xreflection better with IntrospectionUtils. (remm)      + Fix: In HTTP/2 after half closed (remote), any unexpected frame should      be a stream error. (remm)      + Fix: incorrect initial window size calculation when upgrading to HTTP/2.
     (remm)      + Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm)      + Fix: Only try and load the native library from the CATALINA_HOME system      property when the property is set. (markt)      + Fix: max connections enforcement after an enpoint resume. (remm)      + Fix: Implement stricter ALPN matching for Connectors using FFM. (markt)      + Add: length validation for ALPN protocol names. (markt)      + Fix: Make FFM certificate verification more robust. (markt)      + Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing      failure as if no usable OCSP URLs were present. (markt)      + Fix: Make the processing of OCSP responses more robust. (markt)      + Fix: Stricter OCSP handling when soft-fail is disabled. (markt)      + Fix: Cleaner handling of AJP response headers which overflow the maximum      message size. (remm)      + Fix: Small per performance optimisation. Don't waste cycles swallowing      an AJP response body when the connection is going to be closed. (markt)      + Fix: OpenSSL support for CRLs when using OpenSSL trust with the server      key held in a Java key store. (markt)      + Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding      header. (markt)      + Fix: Ensure per request HTTP/2 bad request marker is cleared when the      request is recycled. (markt)      + Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt)      + Fix: Revert earlier refactoring of HTTP/2 header field validation that      moved it earlier since the refactoring made correct handling of invalid      headers more difficult. (markt)
     * Jasper      + Fix: EL evaluation of some lambda expressions. (remm)
     * WebSocket      + Fix: an exception when an automatic Pong response races with the closing      of the WebSocket session. (moritzfl)      + Fix: Harden the WebSocket client and use a SecureRandom when generating      the Sec-WebSocket-Key header. (markt)      + Fix: Improve robustness of client handshakes. (remm)      + Fix: Ensure that WebSocket write timeouts apply to the complete message      and are not lost if two writes have the same timeout. (markt)      + Fix: Reduce CPU usage while sending WebSocket close message. (markt)      + Fix: overly broad check that prevented request URIs containing literal {      and } characters from being mapped to WebSocket end points. (markt)      + Fix: handling of WebSocket messages with compressed payloads using per-      message-deflate that have one or more non-final blocks where the BFINAL      bit is set. (markt)      + Fix: handling of per-message-deflate context takeover when receiving      compressed WebSocket messages. (markt)
     * Web applications      + Fix: Manager: Fix a potential concurrency issue when ordering sessions      prior to displaying a list of session. (markt)      + Docs: Wrap the RewriteRule regular expression syntax reference on narrow      displays. Pull request #1044 by sainadh777. (markt)
     * Other      + Update: Easymock to 5.7.0. (markt)      + Update: bnd to 7.4.0. (markt)      + Update: Tomcat Native to 2.0.16. (markt)      + Add: Improvements to French translations. (remm)      + Add: Improvements to Japanese translations provided by tak7iji and      Ktamura.biz.80. (markt)
     * Cluster      + Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a      positive integer. Zero or negative values previously caused an infinite      loop or a NegativeArraySizeException during session state transfer. Pull      request #1042 provided by lihongyi87. (markt)      + Fix: Improve robustness of cloud membership providers if an error occurs      fetching members. (remm)
     * jdbc-pool      + Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to      getConnection(String,String) rather than getConnection(). (markt)      + Add: Log a warning if an attempt is made to obtain a connection with      credentials when alternateUsernameAllowed is set to false. (markt)      + Fix: Ensure StatementCache interceptor resets properties of cached      statements between uses. (mark)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4544-1 advisory.

    Security issues fixed:

    libtcnative-1-0:

    - CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a     JVM crash       (bsc#1282623).
    - CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF     and       ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622).
    - CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for     some       configurations (bsc#1282621).

    tomcat11:

    - CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore       (bsc#1282631).
    - CVE-2026-75973: improper authentication when Jakarta authentication is configured with     `SimpleAuthConfigProvider`       (bsc#1282630).
    - CVE-2026-76183: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629).
    - CVE-2026-77756: inconsistent interpretation of HTTP requests allows an attacker to cause one request     from another user       to fail when Tomcat is located behind a reverse proxy (bsc#1282628).
    - CVE-2026-77762: stale HPACK emitter injects trailers fields into another HTTP/2 request (bsc#1282599).
    - CVE-2026-77791: uncontrolled resource consumption when sending WebSocket close message enabled a DoS     attack       (bsc#1282627).
    - CVE-2026-78383: allocation of resources without limits or throttling allows an unauthenticated AJP     request to pin an       AJP processing thread leading to denial of service (bsc#1282626).
    - CVE-2026-78437: incomplete cleanup allows a malformed request to potentially cause requests from another     user to fail       (bsc#1282625).
    - CVE-2026-79677: missing release of resource after effective lifetime and comparison using wrong factors     allows for       denial of service due to lost time outs for asynchronous WebSocket writes (bsc#1282624).
    - CVE-2026-86248: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail     is disabled       (bsc#1282620).
    - CVE-2026-86350: HTTP/2 requests can cause request header mix-ups and HTTP request smuggling     (bsc#1282787).
    - CVE-2026-87022: WebSocket message smuggling when per-message-deflate is used (bsc#1282581).

    Changes for libtcnative-1-0:

    - Update to 1.3.9
     * Security fixes      + Client certificate requirements can be down-graded      (bsc#1282621, CVE-2026-86247)      A race condition allowed client certificate verification      requirements to be down-graded for some configurations.
     + Insecure OpenSSL options enabled (bsc#1282622, CVE-2026-86246)      Apache Tomcat Native enabled insecure options by default      including ALLOW_CLIENT_RENEGOTIATION,      NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and      ALLOW_NO_DHE_KEX.
     + DoS via TLS handshake (bsc#1282623, CVE-2026-86243)      A buffer over-read vulnerability in Apache Tomcat Native      during the TLS handshaking permits a malicious user to trigger      a DoS via a JVM crash.
     * Changes      + Code: Remove call to ERR_remove_thread_state() from Windows      specific code to allow building with OpenSSL 4.0.x.
     ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got      removed in OpenSSL 4      + Fix: Fix a potential crash when negotiating ALPN      + If ALPN negotiation fails and failure is configured to use      the last server protocol in the list, use it rather than the      last protocol offered by the client      + Fix: Add support for the extended range of options available      from OpenSSL 3.0.x. The options flag is now a 64-bit unsigned      int (represented by a Java long) rather than a 32-bit unsigned      int (represented by a Java int)      + Code: Remove unused code      + Ensure that per connection changes to certificate verification      settings, e.g. to support client certificate authentication,      do not modify the certificate verification settings for other      connections      + Fix: Fix a potential crash when configuring raw certificates      + Fix: Avoid a potential crash with very long ALPN protocol      names      + Fix: Make the call to a CertificateVerifier more robust      + Fix: Avoid a potential crash when processing OCSP URLs      + Fix: Make the processing of OCSP responses more robust      + Fix: Stricter OCSP handling when soft-fail is disabled      + Fix: Harden against the mis-use of Buffer.address(ByteBuffer)      + Fix: Harden against the mis-use of Pool.destroy(long)      + Code: The minimum supported OpenSSL version is now 3.0.x.
     OpenSSL 1.1.1 support was accidentally broken in 1.3.8. As no      bug reports were receive for that failure and since both      Debian and Ubuntu versions that used OpenSSL 1.1.1 have      reached end of support, OpenSSL 1.1.1 is no longer supported      + Update: OpenSSL 3.0.x is approaching end of support so the      recommended version of OpenSSL (and the version that windows      binaries will be built with) now follows the 3.5.x LTS branch      + Fix: Switch to automatic configuration of DH parameters.
     Manual configuration attempts will be ignored      + Code: Make setTmpECDHByCurveName() a NO-OP      + Fix: Refactor extraction of ECDH curve name from the      Certificate to avoid deprecated OpenSSL methods      + Fix: Refactor the native implementation of SSL.getTime() to      avoid the Y2038 problem in SSL_SESSION_get_time() when running      on a verion of OpenSSL that includes the new      SSL_SESSION_get_time_ex() method

    Changes for tomcat11:

    - Update to Tomcat 11.0.26
     * Catalina      + Fix: Improve the handling of AsyncContext.dispatch() when the Context      attribute dispatchersUseEncodedPaths is set to false since the      application has no control over the path used for the      AsyncContext.dispatch(). Prior to this fix, paths containing literal '?'      characters were truncated. (markt)      + Fix: Ensure that capture groups from a RewriteCond always reflect the      result of the current request. (markt)      + Fix: When a PersistentManager needs to reduce the number of active      sessions, swap out the least recently used eligible sessions first. Pull      request #1045 provided by sainadh777. (markt)      + Fix: Align web.xml logging output with the new Context attribute      urlPatternsProvidedInDecodedForm. (markt)      + Fix: Improve robustness of DIGEST authentication to system clock jumps.
     (markt)      + Add: Support multiple protocol header values (treat as a single merged      header value) in the RemoteIpFilter and RemoteIpValve. (markt)      + Fix: potential concurrency issues when loading/saving sessions from/to a      session store. Custom Store implementations that do not extend StoreBase      must implement the new getSessionStoreLock() method of the Store      interface to ensure concurrency protection. The default method      implementation provided only provides the pre-fix functionality. (markt)      + Fix: Ensure that PersistentManager implementations that extend      PersistentManagerBase do not swap out sessions that are associated with      a request that is currently being processed. This includes not swapping      out a session unless the session was created when activity tracking was      enabled. (markt)      + Fix: Ensure namespace attributes are XML escaped in WebDAV responses.
     + Fix: Resolve null or missing rewrite substitutions as an empty string,      to align with the mod_rewrite behavior. (remm)      + Add: a best efforts protection in the CrawlerSessionManagerValve against      crawlers being associated with an authenticated session. (markt)      + Fix: Clarify the meaning of various RewriteValve server variables and      explicitly use the canonical context path for the CONTEXT_PATH server      variable. (markt)      + Fix: storeconfig not saving the path when a context is saved in      server.xml. (remm)      + Fix: WAR URLConnection should propagate use of caching. (remm)      + Fix: Ensure resources are evicted from the static resource cache in the      correct order. (markt)      + Fix: When Jakarta Authentication is configured for a web application,      cache the ServerAuthConfig in the Authenticator valve. This ensures web      application specific settings are cached on a per web application basis.
     + Fix: 70203: Fix RegistrationListener notifications in Jakarta      Authentication implementation. (markt)      + Fix: Handle CGI scripts that write excessively to stdout after setting      an HTTP error status code. (schultz)      + Fix: Require the request to the login action during FORM authentication      to be made using HTTP POST. (markt)      + Fix: 70208: Make URL encoding more robust. Based on pull request #1065      by Chenjp. (markt)
     * Coyote      + Fix: parsing of client certificates that specify more than one OCSP      responder for configurations that use OpenSSL-FFM. (markt)      + Fix: xreflection generated code stack overflow issue. (remm)      + Fix: Align xreflection better with IntrospectionUtils. (remm)      + Fix: In HTTP/2 after half closed (remote), any unexpected frame should      be a stream error. (remm)      + Fix: incorrect initial window size calculation when upgrading to HTTP/2.
     (remm)      + Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm)      + Fix: Only try and load the native library from the CATALINA_HOME system      property when the property is set. (markt)      + Fix: max connections enforcement after an enpoint resume. (remm)      + Fix: Implement stricter ALPN matching for Connectors using FFM. (markt)      + Add: length validation for ALPN protocol names. (markt)      + Fix: Make FFM certificate verification more robust. (markt)      + Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing      failure as if no usable OCSP URLs were present. (markt)      + Fix: Make the processing of OCSP responses more robust. (markt)      + Fix: Stricter OCSP handling when soft-fail is disabled. (markt)      + Fix: Cleaner handling of AJP response headers which overflow the maximum      message size. (remm)      + Fix: Small per performance optimisation. Don't waste cycles swallowing      an AJP response body when the connection is going to be closed. (markt)      + Fix: OpenSSL support for CRLs when using OpenSSL trust with the server      key held in a Java key store. (markt)      + Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding      header. (markt)      + Fix: Ensure per request HTTP/2 bad request marker is cleared when the      request is recycled. (markt)      + Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt)      + Fix: Revert earlier refactoring of HTTP/2 header field validation that      moved it earlier since the refactoring made correct handling of invalid      headers more difficult. (markt)
     * Jasper      + Fix: EL evaluation of some lambda expressions. (remm)
     * WebSocket      + Fix: an exception when an automatic Pong response races with the closing      of the WebSocket session. (moritzfl)      + Fix: Harden the WebSocket client and use a SecureRandom when generating      the Sec-WebSocket-Key header. (markt)      + Fix: Improve robustness of client handshakes. (remm)      + Fix: Ensure that WebSocket write timeouts apply to the complete message      and are not lost if two writes have the same timeout. (markt)      + Fix: Reduce CPU usage while sending WebSocket close message. (markt)      + Fix: overly broad check that prevented request URIs containing literal {      and } characters from being mapped to WebSocket end points. (markt)      + Fix: handling of WebSocket messages with compressed payloads using per-      message-deflate that have one or more non-final blocks where the BFINAL      bit is set. (markt)      + Fix: handling of per-message-deflate context takeover when receiving      compressed WebSocket messages. (markt)
     * Web applications      + Fix: Manager: Fix a potential concurrency issue when ordering sessions      prior to displaying a list of session. (markt)      + Docs: Wrap the RewriteRule regular expression syntax reference on narrow      displays. Pull request #1044 by sainadh777. (markt)
     * Other      + Update: Easymock to 5.7.0. (markt)      + Update: bnd to 7.4.0. (markt)      + Update: Tomcat Native to 2.0.16. (markt)      + Add: Improvements to French translations. (remm)      + Add: Improvements to Japanese translations provided by tak7iji and      Ktamura.biz.80. (markt)
     * Cluster      + Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a      positive integer. Zero or negative values previously caused an infinite      loop or a NegativeArraySizeException during session state transfer. Pull      request #1042 provided by lihongyi87. (markt)      + Fix: Improve robustness of cloud membership providers if an error occurs      fetching members. (remm)
     * jdbc-pool      + Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to      getConnection(String,String) rather than getConnection(). (markt)      + Add: Log a warning if an attempt is made to obtain a connection with      credentials when alternateUsernameAllowed is set to false. (markt)      + Fix: Ensure StatementCache interceptor resets properties of cached      statements between uses. (mark)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of Apache Tomcat installed on the remote host is 9.0.0.M1 prior to 9.0.122, 10.1.0-M1 prior to 10.1.60, or 11.0.0-M1 prior to 11.0.26. It is, therefore, affected by multiple vulnerabilities:

 - Improper handling of a length parameter allows WebSocket message smuggling when per-message-deflate is used. (CVE-2026-87022)

 - Inconsistent interpretation of HTTP/2 requests caused by a regression in the fix for CVE-2026-41293 can trigger a request header mix-up. (CVE-2026-86350)

 - The fix for CVE-2026-34500 was incomplete: CLIENT_CERT authentication does not fail as expected in some scenarios with FFM when OCSP soft-fail is disabled. (CVE-2026-86248)

 - Due to a concurrency bug, an attacker could trigger a denial of service as a result of lost timeouts for asynchronous WebSocket writes. (CVE-2026-79677)

 - A malformed HTTP/2 request could potentially, depending on timing, cause a request from another user to fail. (CVE-2026-78437)

 - If the end user did not provide a request body, an AJP processing thread could be pinned, leading to a denial of service. (CVE-2026-78383)

 - A busy wait during the sending of a WebSocket close message enables a denial of service attack. (CVE-2026-77791)

 - A race condition involving a stale HPACK emitter allows an attacker to inject trailer fields into another user's HTTP/2 request. (CVE-2026-77762)

 - Processing the Transfer-Encoding header for an HTTP/1.0 request may allow an attacker to cause a request from another user to fail when Tomcat is located behind a reverse proxy. (CVE-2026-77756)

 - Request paths were incorrectly parsed as endpoint templates, allowing the bypass of security constraints for WebSocket endpoints. (CVE-2026-76183)

 - When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications use that provider, the realm of the first web application to authenticate a request is used for all web applications. (CVE-2026-75973)

 - Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when the certificate uses a keystore. (CVE-2026-73581)

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket     message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1     through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions     were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from     7.0.56 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade     to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue. (CVE-2026-87022)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tomcat installed on the remote host is prior to 9.0.122. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.122_security-9 advisory.

  - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from     10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26,     10.1.60 or 9.0.122, which fix the issue. (CVE-2026-86248)

  - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be     affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

  - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following     versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through     8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.59, 9.0.122, which fixes the issue. (CVE-2026-73581)

  - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications. This     issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are     recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue. (CVE-2026-75973)

  - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at     the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through     7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.60 or 9.0.122, which fix the issue. (CVE-2026-76183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 11.0.26. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.26_security-11 advisory.

  - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from     10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26,     10.1.60 or 9.0.122, which fix the issue. (CVE-2026-86248)

  - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be     affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

  - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following     versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through     8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.59, 9.0.122, which fixes the issue. (CVE-2026-73581)

  - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications. This     issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are     recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue. (CVE-2026-75973)

  - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at     the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through     7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.60 or 9.0.122, which fix the issue. (CVE-2026-76183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.60. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.60_security-10 advisory.

  - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled     vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from     10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26,     10.1.60 or 9.0.122, which fix the issue. (CVE-2026-86248)

  - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an     unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be     affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

  - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM     TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from     11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following     versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through     8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.59, 9.0.122, which fixes the issue. (CVE-2026-73581)

  - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with     SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the     realm for the first web application to authenticate a request would be used for all web applications. This     issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4     through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be     affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are     recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue. (CVE-2026-75973)

  - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints     for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through     11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at     the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through     7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version     11.0.26, 10.1.60 or 9.0.122, which fix the issue. (CVE-2026-76183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
365287	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2026-3166)	Nessus	Amazon Linux Local Security Checks	Local	critical
365264	Amazon Linux 2 : tomcat (ALASTOMCAT9-2026-029)	Nessus	Amazon Linux Local Security Checks	Local	critical
365238	Amazon Linux 2023 : tomcat11, tomcat11-admin-webapps, tomcat11-el-6.0-api (ALAS2023-2026-3151)	Nessus	Amazon Linux Local Security Checks	Local	critical
365216	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2026-3165)	Nessus	Amazon Linux Local Security Checks	Local	critical
363782	SUSE SLES15: libtcnative-1-0 / libtcnative-1-0-devel / tomcat / etc (SUSE-SU-2026:4546-1)	Nessus	SuSE Local Security Checks	Local	critical
363770	SUSE SLED15: libtcnative-1-0 / libtcnative-1-0-devel / tomcat11 / etc (SUSE-SU-2026:4544-1)	Nessus	SuSE Local Security Checks	Local	critical
363073	SUSE SLES16: libtcnative-1-0 / libtcnative-2-0 / tomcat / tomcat-admin-webapps / etc (SUSE-SU-2026:23985-1)	Nessus	SuSE Local Security Checks	Local	critical
362525	openSUSE 16: libtcnative-1-0 / libtcnative-1-0-devel / libtcnative-2-0 / etc (openSUSE-SU-2026:21984-1)	Nessus	SuSE Local Security Checks	Local	critical
115549	Apache Tomcat 9.0.x < 9.0.122 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115548	Apache Tomcat 10.1.x < 10.1.60 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115547	Apache Tomcat 11.0.x < 11.0.26 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
349575	Linux Distros Unpatched Vulnerability : CVE-2026-87022	Nessus	Misc.	Local	high
349472	Apache Tomcat 9.0.0.M1 < 9.0.122 multiple vulnerabilities	Nessus	Web Servers	Combined	critical
349471	Apache Tomcat 11.0.0.M1 < 11.0.26 multiple vulnerabilities	Nessus	Web Servers	Combined	critical
349470	Apache Tomcat 10.1.0.M1 < 10.1.60 multiple vulnerabilities	Nessus	Web Servers	Combined	critical

Detections

Analytics

CVE-2026-87022

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical