p PatchFirst

SUSE-SU-2026:1058-1

SUSE-SU-2026:1058-1 · Security update for tomcat

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

This update for tomcat fixes the following issues: Update to Tomcat 9.0.115: - CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895). - CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash (bsc#1246389). - CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318). - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371). - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385). - CVE-2023-44487: Rapid reset attack (bsc#1216182).

Fix available

Published
Updated

Stack: system

Affected products and versions

  • tomcat SUSE:Linux Enterprise Server 12 SP5-LTSS

    Affected ranges
    • ECOSYSTEM: < 9.0.115-3.160.1

    Update to 9.0.115-3.160.1

  • tomcat SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5

    Affected ranges
    • ECOSYSTEM: < 9.0.115-3.160.1

    Update to 9.0.115-3.160.1

Original sources

Check your server →