Summary
Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat APR/native Connector ausnutzen, um einen Denial of Service Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.
Product
Apache Tomcat ist ein Web-Applikationsserver für verschiedene Plattformen.
Vulnerabilities 3
-
Critical 9.1
Apache Tomcat Native: Insecure OpenSSL options enabled
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apa…
-
High 7.5
Apache Tomcat Native: DoS via TLS handshake
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versi…
-
High 7.4
Apache Tomcat Native: Client certificate requirements can be down-graded
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. …
Revision history
-
#10
Neue Updates von Red Hat aufgenommen
-
#9
Neue Updates von Red Hat aufgenommen
-
#8
Neue Updates von Amazon aufgenommen
-
#7
Neue Updates von SUSE aufgenommen
-
#6
Neue Updates von Amazon aufgenommen
-
#5
Neue Updates von SUSE aufgenommen
-
#4
Neue Updates von SUSE aufgenommen
-
#3
Neue Updates von SUSE aufgenommen
-
#2
Neue Updates von openSUSE aufgenommen
-
#1
Initiale Fassung
References
-
GitHub Advisory Database vom 2026-09-23
https://github.com/advisories/GHSA-W68H-FC49-CMRG
-
GitHub Advisory Database vom 2026-09-23
https://github.com/advisories/GHSA-9P2M-JVMJ-WH8Q
-
GitHub Advisory Database vom 2026-09-23
https://github.com/advisories/GHSA-JHRW-X5GG-JJQW
-
Fixed in Apache Tomcat Native Connector 2.0.16 / 1.3.9 vom 2026-09-23
https://tomcat.apache.org/security-native#Fixed_in_Apache_Tomcat_Native_Connector_2.0.16_/_1.3.9
-
openSUSE Security Update OPENSUSE-SU-2026:21984-1 vom 2026-10-01
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EBS7H6JWXNHJWA74MPXQP67LP46IWPSB/
-
openSUSE Security Update OPENSUSE-SU-2026:11898-1 vom 2026-10-01
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FTGBUJURPSOHE4YW7HTX65MNQEBFFQ3M/
-
openSUSE Security Update OPENSUSE-SU-2026:11899-1 vom 2026-10-01
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JIFEEGUHJGUB7XDB2NPHRARKYIHXYFPQ/
-
SUSE Security Update SUSE-SU-2026:23985-1 vom 2026-10-05
https://lists.suse.com/pipermail/sle-security-updates/2026-October/029543.html
-
SUSE Security Update SUSE-SU-2026:4546-1 vom 2026-10-06
https://lists.suse.com/pipermail/sle-security-updates/2026-October/029615.html
-
SUSE Security Update SUSE-SU-2026:4544-1 vom 2026-10-06
https://lists.suse.com/pipermail/sle-security-updates/2026-October/029617.html
-
SUSE Security Update SUSE-SU-2026:4658-1 vom 2026-10-14
https://lists.suse.com/pipermail/sle-security-updates/2026-October/029823.html
-
Amazon Linux Security Advisory ALAS2-2026-4016 vom 2026-10-25
https://alas.aws.amazon.com/AL2/ALAS2-2026-4016.html
-
SUSE Security Update SUSE-SU-2026:4927-1 vom 2026-10-29
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030250.html
-
Amazon Linux Security Advisory ALAS2-2026-4058 vom 2026-10-31
https://alas.aws.amazon.com/AL2/ALAS2-2026-4058.html
-
Red Hat Security Advisory RHSA-2026:93622 vom 2026-11-03
https://access.redhat.com/errata/RHSA-2026:93622
-
Red Hat Security Advisory RHSA-2026:93618 vom 2026-11-03
https://access.redhat.com/errata/RHSA-2026:93618
-
Red Hat Security Advisory RHSA-2026:96229 vom 2026-11-09
https://access.redhat.com/errata/RHSA-2026:96229
-
Red Hat Security Advisory RHSA-2026:96228 vom 2026-11-09
https://access.redhat.com/errata/RHSA-2026:96228