Security update for libapr1, libtcnative-1-0, tomcat
This update for libapr1, libtcnative-1-0, tomcat fixes the following issues:
- CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
(bsc#1282631).
- CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure (bsc#1286502).
- CVE-2026-74049: Jasper JSTL <c:redirect> plug-in implementation omits page abort (bsc#1286555).
- CVE-2026-75973: improper authentication when Jakarta authentication is configured with `SimpleAuthConfigProvider`
(bsc#1282630).
- CVE-2026-76183: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629).
- CVE-2026-77756: inconsistent
This update for tomcat fixes the following issues:
- CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint (bsc#1276893).
- CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets (bsc#1276894).
- CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - fix incomplete (bsc#1276895).
- CVE-2026-65905: Apache Tomcat: Limited replay attack possible with DIGEST authentication (bsc#1276896).
- CVE-2026-65927: Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control
(bsc#1276897).
- CVE-2026-66299: memory exhaustion via malicio
This update for tomcat fixes the following issues:
Update to Tomcat 9.0.120:
Security issues fixed:
- CVE-2026-59083: incorrect URL decoding in `RewriteValve` may allow security control bypass (bsc#1271397).
- CVE-2026-59084: `EncryptInterceptor` requirements are not clearly documented (bsc#1271398).
Other updates and bugfixes:
- Tomcat 9.0.120:
* Catalina
+ Fix: Avoid a race condition with concurrent lookups for a singleton JNDI
resource. (markt)
+ Fix: Improve the performance of range validation for the default
servlet. (markt)
+ Fix: Avoid NPE in RewriteValve. (markt)
+ Fix: 70127: Fix use of Bootstrap th
This update for tomcat fixes the following issues
Update to Tomcat 9.0.119.
Security issues fixed:
- CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
- CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be
skipped if the first condition in an OR chain matched (bsc#1269910).
- CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
- CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints
to not be included
This update for tomcat fixes the following issues:
Security fixes:
- CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
- CVE-2026-25854: Occasionally open redirect (bsc#1261851).
- CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
- CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
- CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
- CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
- CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
This update for tomcat fixes the following issues:
Update to Tomcat 9.0.115:
- CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).
- CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash
(bsc#1246389).
- CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
- CVE-2023-44487: Rapid reset attack (bsc#121
This update for tomcat fixes the following issues:
- CVE-2025-55752: Fixed directory traversal via rewrite with possible RCE if PUT is enabled (bsc#1252753)
- CVE-2025-55754: Fixed improper neutralization of escape, meta, or control sequences vulnerability (bsc#1252905)
- CVE-2025-61795: Fixed denial of service due to temporary copies during the processing of multipart upload (bsc#1252756)
This update for tomcat fixes the following issues:
- CVE-2025-52520: Fixed integer overflow can lead to DoS for some unlikely configurations of multipart upload (bsc#1246388)
- CVE-2025-53506: Fixed uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318)
This update for tomcat fixes the following issues:
- CVE-2025-46701: Refactored CGI servlet to access resources via WebResources (bsc#1243815).
- CVE-2025-48988: Limited the total number of parts in a multi-part request and limits the size of the headers provided with each part (bsc#1244656).
- CVE-2025-49125: Expand checks for webAppMount (bsc#1244649).
This update for tomcat fixes the following issues:
- CVE-2025-24813: Fixed potential RCE and/or information disclosure/corruption with partial PUT (bsc#1239302)
This update for tomcat fixes the following issues:
- CVE-2024-50379: Fixed remote code execution (RCE) due to TOCTOU issue in JSP compilation (bsc#1234663).
- CVE-2024-54677: Fixed denial-of-service (DoS) attack in examples web application (bsc#1234664).
This update for tomcat fixes the following issues:
- CVE-2024-52316: Fixed an authentication bypass when using Jakarta Authentication API (bsc#1233434).