Description
Configured cipher preference order not preserved vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.
Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | 11.0.16 – ≤ 11.0.18, 10.1.51 – ≤ 10.1.52, 9.0.114 – ≤ 9.0.115 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tomcat10 | 10.1.54-1 | — |
| Debian 14 | tomcat11 | 11.0.21-1 | — |
| Debian 14 | tomcat9 | 9.0.70-2 | — |
| Debian 13 | tomcat10 | 10.1.55-1~deb13u1 | — |
| Debian 13 | tomcat11 | 11.0.22-1~deb13u1 | — |
| Debian 13 | tomcat9 | 9.0.70-2 | — |
| Debian 12 | tomcat10 | 10.1.55-1~deb12u1 | — |
| Debian 12 | tomcat9 | 9.0.70-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | tomcat11 | No fix yet | — |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | tomcat9 +7 | 1:9.0.117-2.el10_2.alma.1 | ALSA-2026:36790 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | tomcat | 9.0.117-150200.105.1 | SUSE-SU-2026:1604-1 |
| SLES 15 SP7 | tomcat10 | 10.1.54-150200.5.64.1 | SUSE-SU-2026:1603-1 |
| SLES 15 SP7 | tomcat11 | 11.0.21-150600.13.18.1 | SUSE-SU-2026:1558-1 |
| SLES 15 SP6 | tomcat | 9.0.117-150200.105.1 | SUSE-SU-2026:1604-1 |
| SLES 15 SP6 | tomcat10 | 10.1.54-150200.5.64.1 | SUSE-SU-2026:1603-1 |
| SLES 15 SP6 | tomcat11 | 11.0.21-150600.13.18.1 | SUSE-SU-2026:1558-1 |
| SLES 15 SP5 | tomcat | 9.0.117-150200.105.1 | SUSE-SU-2026:1604-1 |
| SLES 15 SP5 | tomcat10 | 10.1.54-150200.5.64.1 | SUSE-SU-2026:1603-1 |
| SLES 15 SP4 | tomcat | 9.0.117-150200.105.1 | SUSE-SU-2026:1604-1 |
| SLES 12 SP5 | tomcat | 9.0.117-3.163.2 | SUSE-SU-2026:1572-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | tomcat | 9.0.117-150200.105.1 | SUSE-SU-2026:1604-1 |
| SLES for SAP 15 SP6 | tomcat10 | 10.1.54-150200.5.64.1 | SUSE-SU-2026:1603-1 |
| SLES for SAP 15 SP6 | tomcat11 | 11.0.21-150600.13.18.1 | SUSE-SU-2026:1558-1 |
| SLES for SAP 15 SP5 | tomcat | 9.0.117-150200.105.1 | SUSE-SU-2026:1604-1 |
| SLES for SAP 15 SP5 | tomcat10 | 10.1.54-150200.5.64.1 | SUSE-SU-2026:1603-1 |
| SLES for SAP 15 SP4 | tomcat | 9.0.117-150200.105.1 | SUSE-SU-2026:1604-1 |
| SLE HPC 15 SP5 | tomcat | 9.0.117-150200.105.1 | SUSE-SU-2026:1604-1 |
| SLE HPC 15 SP5 | tomcat10 | 10.1.54-150200.5.64.1 | SUSE-SU-2026:1603-1 |
| SLE HPC 15 SP4 | tomcat | 9.0.117-150200.105.1 | SUSE-SU-2026:1604-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tomcat | 9.0.117-1.1 | openSUSE-SU-2026:10547-1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.54-1.1 | openSUSE-SU-2026:10548-1 |
| openSUSE Tumbleweed | tomcat11 | 11.0.21-1.1 | openSUSE-SU-2026:10549-1 |
| openSUSE Leap 16.0 | tomcat | 9.0.117-160000.1.1 | openSUSE-SU-2026:20611-1 |
| openSUSE Leap 16.0 | tomcat10 | 10.1.54-160000.1.1 | openSUSE-SU-2026:20612-1 |
| openSUSE Leap 16.0 | tomcat11 | 11.0.21-160000.1.1 | openSUSE-SU-2026:20595-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | tomcat10 +7 | 1:10.1.54-1.amzn2023.0.1 | ALAS2023-2026-1673 |
| Amazon Linux 2023 | tomcat9 +7 | 1:9.0.117-1.amzn2023.0.1 | ALAS2023-2026-1672 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | thingsboard-tb-node +1 | 4.3.1.1-r11 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 9.0.114, < 9.0.116 | 9.0.116 | GHSA-69cc-cv78-qc8g |
| Maven | org.apache.tomcat:tomcat | >= 10.1.51, < 10.1.53 | 10.1.53 | GHSA-69cc-cv78-qc8g |
| Maven | org.apache.tomcat:tomcat | >= 11.0.16, < 11.0.20 | 11.0.20 | GHSA-69cc-cv78-qc8g |
| Maven | org.apache.tomcat:tomcat-coyote | >= 9.0.114, < 9.0.116 | 9.0.116 | GHSA-69cc-cv78-qc8g |
| Maven | org.apache.tomcat:tomcat-coyote | >= 10.1.51, < 10.1.53 | 10.1.53 | GHSA-69cc-cv78-qc8g |
| Maven | org.apache.tomcat:tomcat-coyote | >= 11.0.16, < 11.0.20 | 11.0.20 | GHSA-69cc-cv78-qc8g |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 9.0.114, < 9.0.116 | 9.0.116 | GHSA-69cc-cv78-qc8g |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 10.1.51, < 10.1.53 | 10.1.53 | GHSA-69cc-cv78-qc8g |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 11.0.16, < 11.0.20 | 11.0.20 | GHSA-69cc-cv78-qc8g |
Advisories 16
- WID-SEC-2026-1038 Apache Tomcat und Tomcat Native: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- ALSA-2026:36790 Important: tomcat9 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-1955 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2026
- WID-SEC-2026-1608 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 19, 2026
- ALAS2023-2026-1673 Moderate: tomcat10 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026
- ALAS2023-2026-1672 Moderate: tomcat9 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026
- SUSE-SU-2026:1604-1 Security update for tomcat SUSE / openSUSE Security Updates · Apr 25, 2026
- SUSE-SU-2026:1603-1 Security update for tomcat10 SUSE / openSUSE Security Updates · Apr 25, 2026
- openSUSE-SU-2026:20611-1 Security update for tomcat SUSE / openSUSE Security Updates · Apr 24, 2026
- openSUSE-SU-2026:20612-1 Security update for tomcat10 SUSE / openSUSE Security Updates · Apr 24, 2026
- SUSE-SU-2026:1572-1 Security update for tomcat SUSE / openSUSE Security Updates · Apr 24, 2026
- SUSE-SU-2026:1558-1 Security update for tomcat11 SUSE / openSUSE Security Updates · Apr 24, 2026
- openSUSE-SU-2026:20595-1 Security update for tomcat11 SUSE / openSUSE Security Updates · Apr 23, 2026
- openSUSE-SU-2026:10547-1 tomcat-9.0.117-1.1 on GA media SUSE / openSUSE Security Updates · Apr 15, 2026
- openSUSE-SU-2026:10548-1 tomcat10-10.1.54-1.1 on GA media SUSE / openSUSE Security Updates · Apr 15, 2026
- openSUSE-SU-2026:10549-1 tomcat11-11.0.21-1.1 on GA media SUSE / openSUSE Security Updates · Apr 15, 2026
References
- https://lists.apache.org/thread/r4h1t6f8xhxsxfm6c2z5cprolsosho3f vendor-advisory