ELSA-2026-36790

ELSA-2026-36790 - tomcat9 security, bug fix, and enhancement update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-16

Description

[1:9.0.117-2]
- Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds

[1:9.0.117-1]
- Resolves: RHEL-150720
Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)
- Resolves:
Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVE-2026-34500)
- Resolves:
Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token (CVE-2026-34487)
- Resolves:
Tomcat: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor (CVE-2026-34486)
- Resolves:
Tomcat: Incomplete escaping of JSON access logs (CVE-2026-34483)
- Resolves:
Tomcat: The fix for CVE-2025-66614 was incomplete (CVE-2026-32990)
- Resolves:
Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default (CVE-2026-29146)
- Resolves:
Tomcat: OCSP checks sometimes soft-fail even when soft-fail is disabled (CVE-2026-29145)
- Resolves:
Tomcat: Configured TLS cipher preference order not preserved (CVE-2026-29129)
- Resolves:
Tomcat: Occasionally open redirect (CVE-2026-25854)
- Resolves:
Tomcat: Request smuggling via invalid chunk extension (CVE-2026-24880)
- Resolves:
Tomcat: Incomplete OCSP verification checks (CVE-2026-24734)
- Resolves:
Tomcat: Security constraint bypass (CVE-2026-24733)
- Resolves:
Tomcat: Client certificate verification bypass due to virtual host mapping (CVE-2025-66614)

Related CVEs

CVE-2026-29146

CVE-2026-34486

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	tomcat9-9.0.117-2.el10_2.src.rpm	5150f401998456edabd3c947f6a5f789948d9e916dacb85094399dde065cc12a	-	ol10_aarch64_appstream
	tomcat9-9.0.117-2.el10_2.noarch.rpm	43fa153eb8b81783411ec4512c0bddb2374c95dd9d7edaccc73abfd930ede53e	-	ol10_aarch64_appstream
	tomcat9-admin-webapps-9.0.117-2.el10_2.noarch.rpm	fe0aa922c14c2a355b89c5b06592b83e237cf21d04ae7716731057d3b0ad3165	-	ol10_aarch64_appstream
	tomcat9-docs-webapp-9.0.117-2.el10_2.noarch.rpm	9ca2ec291f787b109040b216c61c6127ffd2a59a7fd821507fc0fdd3aca0524b	-	ol10_aarch64_appstream
	tomcat9-el-3.0-api-9.0.117-2.el10_2.noarch.rpm	d4862cd9b7228db5dd55cad145a570e74e36540b8324e15ddf452af365acb887	-	ol10_aarch64_appstream
	tomcat9-jsp-2.3-api-9.0.117-2.el10_2.noarch.rpm	7c222021824a7e1002e2c9a9b6815cab348b2bab4ba760a06c19451805e11fa4	-	ol10_aarch64_appstream
	tomcat9-lib-9.0.117-2.el10_2.noarch.rpm	83275d775e36efbf739d883b2cde221721057a133962b5b5359c2aa72e61d3eb	-	ol10_aarch64_appstream
	tomcat9-servlet-4.0-api-9.0.117-2.el10_2.noarch.rpm	bbaf037795cda40a7d1a7f2629b5e071bd0f0087df016a173d8975987657f9cd	-	ol10_aarch64_appstream
	tomcat9-webapps-9.0.117-2.el10_2.noarch.rpm	cdaf6c9e7568041107c6f6ae5d74fb286922fed931b8d312ed501b8163b4f0bf	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	tomcat9-9.0.117-2.el10_2.src.rpm	5150f401998456edabd3c947f6a5f789948d9e916dacb85094399dde065cc12a	-	ol10_x86_64_appstream
	tomcat9-9.0.117-2.el10_2.noarch.rpm	43fa153eb8b81783411ec4512c0bddb2374c95dd9d7edaccc73abfd930ede53e	-	ol10_x86_64_appstream
	tomcat9-admin-webapps-9.0.117-2.el10_2.noarch.rpm	fe0aa922c14c2a355b89c5b06592b83e237cf21d04ae7716731057d3b0ad3165	-	ol10_x86_64_appstream
	tomcat9-docs-webapp-9.0.117-2.el10_2.noarch.rpm	9ca2ec291f787b109040b216c61c6127ffd2a59a7fd821507fc0fdd3aca0524b	-	ol10_x86_64_appstream
	tomcat9-el-3.0-api-9.0.117-2.el10_2.noarch.rpm	d4862cd9b7228db5dd55cad145a570e74e36540b8324e15ddf452af365acb887	-	ol10_x86_64_appstream
	tomcat9-jsp-2.3-api-9.0.117-2.el10_2.noarch.rpm	7c222021824a7e1002e2c9a9b6815cab348b2bab4ba760a06c19451805e11fa4	-	ol10_x86_64_appstream
	tomcat9-lib-9.0.117-2.el10_2.noarch.rpm	83275d775e36efbf739d883b2cde221721057a133962b5b5359c2aa72e61d3eb	-	ol10_x86_64_appstream
	tomcat9-servlet-4.0-api-9.0.117-2.el10_2.noarch.rpm	bbaf037795cda40a7d1a7f2629b5e071bd0f0087df016a173d8975987657f9cd	-	ol10_x86_64_appstream
	tomcat9-webapps-9.0.117-2.el10_2.noarch.rpm	cdaf6c9e7568041107c6f6ae5d74fb286922fed931b8d312ed501b8163b4f0bf	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team