Apache Tomcat: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 7

• Critical 9.8
  CVE-2026-41293 Public exploit

  Apache Tomcat: HTTP/2 request headers not validated

  Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also …

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.8
  CVE-2026-43512 Public exploit

  Apache Tomcat: Digest authenticator will authenticate any unknown user

  DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Critical 9.1
  CVE-2026-43515 Public exploit

  Apache Tomcat: Security constraints not correctly applied

  Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.11…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.5
  CVE-2026-41284

  Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affec…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.5
  CVE-2026-43513

  Apache Tomcat: LockOutRealm treats user names as case-sensitive

  Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• High 7.3
  CVE-2026-42498

  Apache Tomcat: WebSocket authentication header exposure

  Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.2…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026
• Low 3.7
  CVE-2026-43514

  Apache Tomcat: AJP secret compared in non-constant time

  Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 thr…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 12, 2026

Revision history

1. 2026-11-12 #31

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

2. 2026-11-11 #30

   Neue Updates von Red Hat aufgenommen

3. 2026-11-05 #29

   Neue Updates von IBM aufgenommen

4. 2026-10-29 #28

   Neue Updates von SUSE aufgenommen

5. 2026-10-12 #27

   Neue Updates von Amazon aufgenommen

6. 2026-10-07 #26

   Neue Updates aufgenommen

7. 2026-09-23 #25

   Neue Updates von BROCADE und European Union Vulnerability Database aufgenommen

8. 2026-09-22 #24

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

9. 2026-09-21 #23

   Neue Updates von Oracle Linux aufgenommen

10. 2026-09-20 #22

    Neue Updates von Oracle Linux und Rocky Enterprise Software Foundation aufgenommen

11. 2026-09-17 #21

    Neue Updates von Red Hat aufgenommen

12. 2026-09-13 #20

    Neue Updates von Red Hat aufgenommen

13. 2026-09-03 #19

    Neue Updates von Dell aufgenommen

14. 2026-08-31 #18

    Neue Updates von Dell aufgenommen

15. 2026-08-11 #17

    Neue Updates von Red Hat aufgenommen

16. 2026-08-05 #16

    Neue Updates von IBM aufgenommen

17. 2026-07-22 #15

    Neue Updates von Red Hat aufgenommen

18. 2026-07-15 #14

    Neue Updates von Ubuntu aufgenommen

19. 2026-07-14 #13

    Neue Updates von Red Hat aufgenommen

20. 2026-07-01 #12

    Neue Updates von IBM aufgenommen

21. 2026-06-29 #11

    Neue Updates von SUSE aufgenommen

22. 2026-06-23 #10

    Neue Updates von SUSE aufgenommen

23. 2026-06-18 #9

    Neue Updates von Ubuntu aufgenommen

24. 2026-06-11 #8

    Neue Updates von SUSE aufgenommen

25. 2026-06-10 #7

    Neue Updates von Red Hat aufgenommen

References

• Tomcat 9.0.118 Changelog vom 2026-05-12
  https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.118_%28remm%29
• Tomcat 10.1.55 Changelog vom 2026-05-12
  https://tomcat.apache.org/tomcat-10.1-doc/changelog.html#Tomcat_10.1.55_%28schultz%29
• Tomcat 11.0.22 Changelog vom 2026-05-12
  https://tomcat.apache.org/tomcat-11.0-doc/changelog.html#Tomcat_11.0.22_%28markt%29
• CVE-2026-41284: Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling vom 2026-05-12
  https://seclists.org/oss-sec/2026/q2/499
• CVE-2026-41293: Apache Tomcat: HTTP/2 request headers not validated vom 2026-05-12
  https://seclists.org/oss-sec/2026/q2/500
• CVE-2026-42498: Apache Tomcat: WebSocket authentication header exposure vom 2026-05-12
  https://seclists.org/oss-sec/2026/q2/501
• CVE-2026-43512: Apache Tomcat: Digest authenticator will authenticate any unknown user vom 2026-05-12
  https://seclists.org/oss-sec/2026/q2/495
• CVE-2026-43513: Apache Tomcat: LockOutRealm treats user names as case-sensitive vom 2026-05-12
  https://seclists.org/oss-sec/2026/q2/496
• CVE-2026-43514: Apache Tomcat: AJP secret compared in non-constant time vom 2026-05-12
  https://seclists.org/oss-sec/2026/q2/497
• CVE-2026-43515: Apache Tomcat: Security constraints not correctly applied vom 2026-05-12
  https://seclists.org/oss-sec/2026/q2/498
• Red Hat Security Advisory RHSA-2026:13745 vom 2026-05-28
  https://access.redhat.com/errata/RHSA-2026:13745
• Red Hat Security Advisory RHSA-2026:16528 vom 2026-05-28
  https://access.redhat.com/errata/RHSA-2026:16528
• openSUSE Security Update OPENSUSE-SU-2026:10926-1 vom 2026-06-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EAWPQZS5U2ZRRCJCB7SUATFWSLFSQJ45/
• openSUSE Security Update OPENSUSE-SU-2026:10927-1 vom 2026-06-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/I5CAG66XW37HZ5G7VC4CN4HMJYOCCYA6/
• Debian Security Advisory DLA-4619 vom 2026-06-07
  https://lists.debian.org/debian-lts-announce/2026/06/msg00008.html
• openSUSE Security Update OPENSUSE-SU-2026:10925-1 vom 2026-06-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CVVBYAOA37ASFUT7AGSXLIKJLFQDFQ6F/
• Amazon Linux Security Advisory ALAS2TOMCAT9-2026-026 vom 2026-06-08
  https://alas.aws.amazon.com/AL2/ALAS2TOMCAT9-2026-026.html
• SUSE Security Update SUSE-SU-2026:2299-1 vom 2026-06-08
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026605.html
• Debian Security Advisory DSA-6329 vom 2026-06-08
  https://security-tracker.debian.org/tracker/DSA-6329-1
• Debian Security Advisory DSA-6328 vom 2026-06-08
  https://security-tracker.debian.org/tracker/DSA-6328-1
• Ubuntu Security Notice USN-8417-1 vom 2026-06-10
  https://ubuntu.com/security/notices/USN-8417-1
• Red Hat Security Advisory RHSA-2026:25123 vom 2026-06-11
  https://access.redhat.com/errata/RHSA-2026:25123
• SUSE Security Update SUSE-SU-2026:2374-1 vom 2026-06-11
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026709.html
• SUSE Security Update SUSE-SU-2026:2377-1 vom 2026-06-11
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026706.html
• Ubuntu Security Notice USN-8450-1 vom 2026-06-18
  https://ubuntu.com/security/notices/USN-8450-1
• SUSE Security Update SUSE-SU-2026:22196-1 vom 2026-06-23
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026897.html
• SUSE Security Update SUSE-SU-2026:22195-1 vom 2026-06-23
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026898.html
• SUSE Security Update SUSE-SU-2026:22197-1 vom 2026-06-23
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026896.html
• SUSE Security Update SUSE-SU-2026:2675-1 vom 2026-06-29
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/027065.html
• openSUSE Security Update OPENSUSE-SU-2026:21122-1 vom 2026-06-30
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GUMFMEBTQLEY3EVXVXVHG6RW26L4Y7BQ/
• openSUSE Security Update OPENSUSE-SU-2026:21117-1 vom 2026-06-30
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SWDN4PIMO5KTTRWQ7IEDYRBHPO64B7H7/
• openSUSE Security Update OPENSUSE-SU-2026:21121-1 vom 2026-06-30
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZBPSLMAYL6U4OM3ZLIFNP4RR3WVQSDFC/
• IBM Security Bulletin 7278738 vom 2026-07-01
  https://www.ibm.com/support/pages/node/7278738
• Red Hat Security Advisory RHSA-2026:39189 vom 2026-07-14
  https://access.redhat.com/errata/RHSA-2026:39189
• Ubuntu Security Notice USN-8551-1 vom 2026-07-15
  https://ubuntu.com/security/notices/USN-8551-1
• Red Hat Security Advisory RHSA-2026:43402 vom 2026-07-22
  https://access.redhat.com/errata/RHSA-2026:43402
• Red Hat Security Advisory RHSA-2026:43401 vom 2026-07-22
  https://access.redhat.com/errata/RHSA-2026:43401
• IBM Security Bulletin 7282618 vom 2026-08-05
  https://www.ibm.com/support/pages/node/7282618
• Red Hat Security Advisory RHSA-2026:44426 vom 2026-08-12
  https://access.redhat.com/errata/RHSA-2026:44426
• Red Hat Security Advisory RHSA-2026:44427 vom 2026-08-12
  https://access.redhat.com/errata/RHSA-2026:44427
• Dell Security Advisory DSA-2026-386 vom 2026-09-01
  https://www.dell.com/support/kbdoc/000503504/dsa-2026-386-security-update-f
• Dell Security Advisory DSA-2026-313 vom 2026-09-04
  https://www.dell.com/support/kbdoc/de-de/000505510/dsa-2026-313-security-update-for-dell-avamar-dell-networker-virtual-edition-nve-and-dell-powerprotect-dp-series-appliance-dell-integrated-data-protection-appliance-idpa-multiple-third-party-vulnerabilities
• Red Hat Security Advisory RHSA-2026:67164 vom 2026-09-14
  https://access.redhat.com/errata/RHSA-2026:67164
• Red Hat Security Advisory RHSA-2026:67163 vom 2026-09-14
  https://access.redhat.com/errata/RHSA-2026:67163
• Red Hat Security Advisory RHSA-2026:68677 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68677
• Red Hat Security Advisory RHSA-2026:68660 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68660
• Red Hat Security Advisory RHSA-2026:68651 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68651
• Red Hat Security Advisory RHSA-2026:68679 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68679
• Red Hat Security Advisory RHSA-2026:68680 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68680
• Red Hat Security Advisory RHSA-2026:68659 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68659
• Red Hat Security Advisory RHSA-2026:68678 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68678
• Oracle Linux Security Advisory ELSA-2026-68660 vom 2026-09-18
  https://linux.oracle.com/errata/ELSA-2026-68660.html
• Oracle Linux Security Advisory ELSA-2026-68651 vom 2026-09-18
  https://linux.oracle.com/errata/ELSA-2026-68651.html
• Rocky Linux Security Advisory RLSA-2026:68677 vom 2026-09-19
  https://errata.build.resf.org/RLSA-2026:68677
• Rocky Linux Security Advisory RLSA-2026:68660 vom 2026-09-19
  https://errata.build.resf.org/RLSA-2026:68660
• Rocky Linux Security Advisory RLSA-2026:68651 vom 2026-09-19
  https://errata.build.resf.org/RLSA-2026:68651
• Oracle Linux Security Advisory ELSA-2026-68677 vom 2026-09-18
  https://linux.oracle.com/errata/ELSA-2026-68677.html
• Red Hat Security Advisory RHSA-2026:69259 vom 2026-09-21
  https://access.redhat.com/errata/RHSA-2026:69259
• Oracle Linux Security Advisory ELSA-2026-69259 vom 2026-09-21
  https://linux.oracle.com/errata/ELSA-2026-69259.html
• Rocky Linux Security Advisory RLSA-2026:69259 vom 2026-09-22
  https://errata.build.resf.org/RLSA-2026:69259
• Brocade Security Advisory BSA-2026-3900 vom 2026-09-24
  https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39010
• Absolute Secure Access Security Information vom 2026-10-07
  https://www.absolute.com/platform/security-information/vulnerability-archive/multiple-vulnerabilities-addressed-in-secure-access-14-60-and-insights-for-network-4-50
• Amazon Linux Security Advisory ALAS2TOMCAT9-2026-029 vom 2026-10-13
  https://alas.aws.amazon.com/AL2/ALAS2TOMCAT9-2026-029.html
• SUSE Security Update SUSE-SU-2026:4927-1 vom 2026-10-29
  https://lists.suse.com/pipermail/sle-security-updates/2026-October/030250.html
• IBM Security Bulletin 7295802 vom 2026-11-06
  https://www.ibm.com/support/pages/node/7295802
• Red Hat Security Advisory RHSA-2026:99174 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99174
• Rocky Linux Security Advisory RLSA-2026:99174 vom 2026-11-13
  https://errata.build.resf.org/RLSA-2026:99174