Apache Tomcat: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 7

• Critical 9.1
  CVE-2026-53434

  Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

  Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users ar…

  Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven
  Jun 29, 2026
• Critical 9.1
  CVE-2026-55276

  Apache Tomcat: Logged effective web.xml is incomplete

  Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22,…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven
  Jun 29, 2026
• High 7.3
  CVE-2026-53404

  Apache Tomcat: Bad ornext processing in RewriteValve

  Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, …

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026
• High 7.3
  CVE-2026-55957 Public exploit

  Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

  Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026
• Medium 6.5
  CVE-2026-55955

  Apache Tomcat: EncryptInterceptor not protected against replay attacks

  Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026
• Medium 6.5
  CVE-2026-55956

  Apache Tomcat: Security constraints for default servlet ignored method

  Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026
• Medium 6.1
  CVE-2026-50229 Public exploit Scanner template

  Apache Tomcat: XSS in number guess example

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through …

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026

Revision history

1. 2026-11-12 #20

   Neue Updates von Debian aufgenommen

2. 2026-11-09 #19

   Neue Updates von Debian aufgenommen

3. 2026-10-01 #18

   Neue Updates von Red Hat aufgenommen

4. 2026-09-23 #17

   Neue Updates von BROCADE aufgenommen

5. 2026-09-21 #16

   Neue Updates von IBM aufgenommen

6. 2026-09-20 #15

   Neue Updates von Oracle Linux und Rocky Enterprise Software Foundation aufgenommen

7. 2026-09-17 #14

   Neue Updates von Red Hat aufgenommen

8. 2026-09-13 #13

   Neue Updates von Red Hat aufgenommen

9. 2026-08-31 #12

   Neue Updates von Dell aufgenommen

10. 2026-08-17 #11

    Neue Updates von Amazon aufgenommen

11. 2026-08-05 #10

    Neue Updates von Red Hat aufgenommen

12. 2026-07-22 #9

    Neue Updates von Red Hat aufgenommen

13. 2026-07-21 #8

    Neue Updates von SUSE aufgenommen

14. 2026-07-20 #7

    Neue Updates von Amazon aufgenommen

15. 2026-07-19 #6

    Neue Updates von SUSE aufgenommen

16. 2026-07-16 #5

    Neue Updates von SUSE aufgenommen

17. 2026-07-15 #4

    Neue Updates von Ubuntu aufgenommen

18. 2026-07-14 #3

    Neue Updates von Red Hat aufgenommen

19. 2026-07-08 #2

    Neue Updates von openSUSE aufgenommen

20. 2026-06-29 #1

    Initiale Fassung

References

• GitHub Security Advisory GHSA-4x29-79gh-6v8q vom 2026-06-29
  https://github.com/advisories/GHSA-4x29-79gh-6v8q
• GitHub Security Advisory GHSA-5v3h-fjv2-54fg vom 2026-06-29
  https://github.com/advisories/GHSA-5v3h-fjv2-54fg
• GitHub Security Advisory GHSA-7895-gffq-w6jq vom 2026-06-29
  https://github.com/advisories/GHSA-7895-gffq-w6jq
• GitHub Security Advisory GHSA-c5ph-rghf-fjfj vom 2026-06-29
  https://github.com/advisories/GHSA-c5ph-rghf-fjfj
• GitHub Security Advisory GHSA-mqg3-r7h5-24x4 vom 2026-06-29
  https://github.com/advisories/GHSA-mqg3-r7h5-24x4
• GitHub Security Advisory GHSA-PG42-RG8C-J886 vom 2026-06-29
  https://github.com/advisories/GHSA-PG42-RG8C-J886
• GitHub Security Advisory GHSA-H792-V28V-PPGR vom 2026-06-29
  https://github.com/advisories/GHSA-H792-V28V-PPGR
• openSUSE Security Update OPENSUSE-SU-2026:11195-1 vom 2026-07-08
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TCOZWVOSSPCRORP3OMSICQT5MPT5Z7FL/
• Red Hat Security Advisory RHSA-2026:39189 vom 2026-07-14
  https://access.redhat.com/errata/RHSA-2026:39189
• openSUSE Security Update OPENSUSE-SU-2026:21329-1 vom 2026-07-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GUM3J7NCFJJDCVZU3MRFJSJ4P75CA4DU/
• openSUSE Security Update OPENSUSE-SU-2026:21327-1 vom 2026-07-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/654TBDHUNFIPHX45WIOCKLK57NAQ3FS6/
• Ubuntu Security Notice USN-8551-1 vom 2026-07-15
  https://ubuntu.com/security/notices/USN-8551-1
• SUSE Security Update SUSE-SU-2026:22648-1 vom 2026-07-16
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027561.html
• SUSE Security Update SUSE-SU-2026:22646-1 vom 2026-07-16
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027563.html
• SUSE Security Update SUSE-SU-2026:22647-1 vom 2026-07-16
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027562.html
• SUSE Security Update SUSE-SU-2026:3088-1 vom 2026-07-17
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027593.html
• SUSE Security Update SUSE-SU-2026:3087-1 vom 2026-07-17
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027594.html
• SUSE Security Update SUSE-SU-2026:3112-1 vom 2026-07-17
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027615.html
• Amazon Linux Security Advisory ALAS2TOMCAT9-2026-027 vom 2026-07-20
  https://alas.aws.amazon.com/AL2/ALAS2TOMCAT9-2026-027.html
• SUSE Security Update SUSE-SU-2026:3167-1 vom 2026-07-22
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027694.html
• Red Hat Security Advisory RHSA-2026:43402 vom 2026-07-22
  https://access.redhat.com/errata/RHSA-2026:43402
• Red Hat Security Advisory RHSA-2026:43401 vom 2026-07-22
  https://access.redhat.com/errata/RHSA-2026:43401
• Red Hat Security Advisory RHSA-2026:49951 vom 2026-08-05
  https://access.redhat.com/errata/RHSA-2026:49951
• Red Hat Security Advisory RHSA-2026:49952 vom 2026-08-05
  https://access.redhat.com/errata/RHSA-2026:49952
• Amazon Linux Security Advisory ALAS2-2026-3864 vom 2026-08-18
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3864.html
• Dell Security Advisory DSA-2026-385 vom 2026-08-31
  https://www.dell.com/support/kbdoc/de-de/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities
• Red Hat Security Advisory RHSA-2026:67163 vom 2026-09-14
  https://access.redhat.com/errata/RHSA-2026:67163
• Red Hat Security Advisory RHSA-2026:67164 vom 2026-09-14
  https://access.redhat.com/errata/RHSA-2026:67164
• Red Hat Security Advisory RHSA-2026:68678 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68678
• Red Hat Security Advisory RHSA-2026:68677 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68677
• Red Hat Security Advisory RHSA-2026:68680 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68680
• Red Hat Security Advisory RHSA-2026:68679 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68679
• Oracle Linux Security Advisory ELSA-2026-68677 vom 2026-09-18
  https://linux.oracle.com/errata/ELSA-2026-68677.html
• Rocky Linux Security Advisory RLSA-2026:68677 vom 2026-09-19
  https://errata.build.resf.org/RLSA-2026:68677
• IBM Security Bulletin 7288810 vom 2026-09-22
  https://www.ibm.com/support/pages/node/7288810
• Brocade Security Advisory BSA-2026-3900 vom 2026-09-24
  https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39010
• Red Hat Security Advisory RHSA-2026:73981 vom 2026-10-02
  https://access.redhat.com/errata/RHSA-2026:73981
• Red Hat Security Advisory RHSA-2026:73982 vom 2026-10-01
  https://access.redhat.com/errata/RHSA-2026:73982
• Debian Security Advisory DLA-4889 vom 2026-11-09
  https://lists.debian.org/debian-lts-announce/2026/11/msg00014.html
• Debian Security Advisory DSA-6623 vom 2026-11-13
  https://lists.debian.org/debian-security-announce/2026/msg00543.html