Skip to content
OpenAdvisories
High ALAS2023-2026-1776 7 CVEs

Important: tomcat10 security update (Amazon Linux 2023)

Published Jun 8, 2026 · Updated Jun 8, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-43515: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue. CVE-2026-43514: Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue. CVE-2026-43513: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue. CVE-2026-43512: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue. CVE-2026-42498: Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue. CVE-2026-41293: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. CVE-2026-41284: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2023 tomcat10 1:10.1.55-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-admin-webapps 1:10.1.55-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-docs-webapp 1:10.1.55-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-el-5.0-api 1:10.1.55-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-jsp-3.1-api 1:10.1.55-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-lib 1:10.1.55-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-servlet-6.0-api 1:10.1.55-1.amzn2023.0.1
Amazon Linux · 2023 tomcat10-webapps 1:10.1.55-1.amzn2023.0.1

Vulnerabilities 7

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-41284.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-41293.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-42498.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-43512.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-43513.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-43514.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-43515.html