ELSA-2026-36788

ELSA-2026-36788 - tomcat security, bug fix, and enhancement update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-16

Description

[1:10.1.49-3]
- Related: RHEL-168577 Remove unnecessary patch

[1:10.1.49-2]
- Resolves: RHEL-168577 Remove tomcat clustering JAR from RPM builds
Resolves: CVE-2026-29146
tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor
Resolves: CVE-2026-34486
tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass

[1:10.1.36-3.el10_1.1]
- Resolves: RHEL-150719
Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)

Related CVEs

CVE-2026-29146

CVE-2026-34486

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	tomcat-10.1.49-3.el10_2.src.rpm	f6cf1694b579396af349a3bbdc403901423e99d2aa46aa75c4142aa9e3f542dc	-	ol10_aarch64_appstream
	tomcat-10.1.49-3.el10_2.noarch.rpm	dbaeb1cc92aca79229718e8c06bb1334bbbc77acacc9d3f0f331c58ba732a9b4	-	ol10_aarch64_appstream
	tomcat-admin-webapps-10.1.49-3.el10_2.noarch.rpm	5c9eac6e702319916c3737414261d89386eb3d045726d5893306769a4fca0928	-	ol10_aarch64_appstream
	tomcat-docs-webapp-10.1.49-3.el10_2.noarch.rpm	eb43064cf5277114b647ca1734b3eac4e580f6e6fcdc328521a99e6e975fde5f	-	ol10_aarch64_appstream
	tomcat-el-5.0-api-10.1.49-3.el10_2.noarch.rpm	ac6b2aca152d4576bfb6bf2b2dee729855b43ec8cb226032667ca98b2f088a0c	-	ol10_aarch64_appstream
	tomcat-jsp-3.1-api-10.1.49-3.el10_2.noarch.rpm	dde99fac02ae3c8d717d2a7ed6d32fdbf1dd9876faf9ccc5aa6565324ac4a760	-	ol10_aarch64_appstream
	tomcat-lib-10.1.49-3.el10_2.noarch.rpm	fbcfdc7e3fe5d7160b041eba60b179e6a2de9622b50c3cf55c368f219cfeba19	-	ol10_aarch64_appstream
	tomcat-servlet-6.0-api-10.1.49-3.el10_2.noarch.rpm	b8c7c9216b27c8547e1889920ed84618cec49a6997139d3d4ba9676a3b716159	-	ol10_aarch64_appstream
	tomcat-webapps-10.1.49-3.el10_2.noarch.rpm	b4be2677f0c63a6d385116f684ac337e438b2258ab2fd5e37d3537fa8d510e28	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	tomcat-10.1.49-3.el10_2.src.rpm	f6cf1694b579396af349a3bbdc403901423e99d2aa46aa75c4142aa9e3f542dc	-	ol10_x86_64_appstream
	tomcat-10.1.49-3.el10_2.noarch.rpm	dbaeb1cc92aca79229718e8c06bb1334bbbc77acacc9d3f0f331c58ba732a9b4	-	ol10_x86_64_appstream
	tomcat-admin-webapps-10.1.49-3.el10_2.noarch.rpm	5c9eac6e702319916c3737414261d89386eb3d045726d5893306769a4fca0928	-	ol10_x86_64_appstream
	tomcat-docs-webapp-10.1.49-3.el10_2.noarch.rpm	eb43064cf5277114b647ca1734b3eac4e580f6e6fcdc328521a99e6e975fde5f	-	ol10_x86_64_appstream
	tomcat-el-5.0-api-10.1.49-3.el10_2.noarch.rpm	ac6b2aca152d4576bfb6bf2b2dee729855b43ec8cb226032667ca98b2f088a0c	-	ol10_x86_64_appstream
	tomcat-jsp-3.1-api-10.1.49-3.el10_2.noarch.rpm	dde99fac02ae3c8d717d2a7ed6d32fdbf1dd9876faf9ccc5aa6565324ac4a760	-	ol10_x86_64_appstream
	tomcat-lib-10.1.49-3.el10_2.noarch.rpm	fbcfdc7e3fe5d7160b041eba60b179e6a2de9622b50c3cf55c368f219cfeba19	-	ol10_x86_64_appstream
	tomcat-servlet-6.0-api-10.1.49-3.el10_2.noarch.rpm	b8c7c9216b27c8547e1889920ed84618cec49a6997139d3d4ba9676a3b716159	-	ol10_x86_64_appstream
	tomcat-webapps-10.1.49-3.el10_2.noarch.rpm	b4be2677f0c63a6d385116f684ac337e438b2258ab2fd5e37d3537fa8d510e28	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team