The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1603-1 advisory.

    Security fixes:

    - CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
    - CVE-2026-25854: Occasionally open redirect (bsc#1261851).
    - CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
    - CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
    - CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
    - CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
    - CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token     (bsc#1261856).
    - CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
    - CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

    Other fixes:

    - Update to Tomcat 10.1.54

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES15 Security Update : tomcat10 (SUSE-SU-2026:1603-1)

high Nessus Plugin ID 310234

Version 1.2

Version 1.1

Version 1.2 Aug 5, 2026, 2:08 AM CISA reference CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:A") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Plugin Feed: 202608050208
Version 1.1 Apr 25, 2026, 11:38 AM New Plugin Feed: 202604251138