The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:68651 advisory.

    * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix     (CVE-2026-32990)

    * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)

    * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)

    * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during     WebSocket authentication. (CVE-2026-42498)

    * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)

    * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)

    * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve     (CVE-2026-59083)

    * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure     configurations (CVE-2026-59084)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69259 advisory.

    * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix     (CVE-2026-32990)

    * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)

    * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)

    * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during     WebSocket authentication (CVE-2026-42498)

    * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)

    * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20595-1 advisory.

    - Update to Tomcat 11.0.21
    - CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
    - CVE-2026-25854: Occasionally open redirect (bsc#1261851).
    - CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
    - CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
    - CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
    - CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
    - CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token     (bsc#1261856).
    - CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
    - CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1603-1 advisory.

    Security fixes:

    - CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
    - CVE-2026-25854: Occasionally open redirect (bsc#1261851).
    - CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
    - CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
    - CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
    - CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
    - CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token     (bsc#1261856).
    - CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
    - CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

    Other fixes:

    - Update to Tomcat 10.1.54

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
348575	RockyLinux 10 : tomcat9 (RLSA-2026:68651)	Nessus	Rocky Linux Local Security Checks	9/21/2026	9/25/2026	medium
348785	RockyLinux 10 : tomcat update (Moderate) (RLSA-2026:69259)	Nessus	Rocky Linux Local Security Checks	9/22/2026	9/22/2026	medium
309888	openSUSE 16 Security Update : tomcat11 (openSUSE-SU-2026:20595-1)	Nessus	SuSE Local Security Checks	4/23/2026	8/4/2026	high
310234	SUSE SLES15 Security Update : tomcat10 (SUSE-SU-2026:1603-1)	Nessus	SuSE Local Security Checks	4/25/2026	8/4/2026	high

Detections

Analytics

Plugins Search

medium

medium

high

high