ELSA-2026-68651

ELSA-2026-68651 - tomcat9 security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-09-18

Description

[1:9.0.120-1]
- Resolves: RHEL-192649 Tomcat9: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)
- Resolves: RHEL-192818 Tomcat9: HTTP/2 request headers not validated (CVE-2026-41293)
- Resolves: RHEL-219582 Tomcat9: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)
- Resolves: RHEL-219556 Tomcat9: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
- Resolves: RHEL-238296 tomcat9: Authentication bypass via digest authentication (CVE-2026-43512)
- Resolves: RHEL-238255 tomcat9: Improper Authorization allows security bypass (CVE-2026-43515)
- Resolves: RHEL-238232 tomcat9: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
- Resolves: RHEL-238193 tomcat9: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498)

Related CVEs

CVE-2026-32990

CVE-2026-41293

CVE-2026-42498

CVE-2026-43512

CVE-2026-43513

CVE-2026-43515

CVE-2026-59083

CVE-2026-59084

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	tomcat9-9.0.120-1.el10_2.src.rpm	b5433d45ebdf074defa9b24f761bcfa6ff6d40b5c3a756a4333a2a253962ea4e	-	ol10_aarch64_appstream
	tomcat9-9.0.120-1.el10_2.noarch.rpm	8c4d8d86e51dd3a147e3de1af19b01e215cfb0ef6439ce0598c3fe8bbb1cc882	-	ol10_aarch64_appstream
	tomcat9-admin-webapps-9.0.120-1.el10_2.noarch.rpm	d944a2cab375da633da4c1aecc5ee3cb6f6b35ed48f49a8c3e32123016e94dba	-	ol10_aarch64_appstream
	tomcat9-docs-webapp-9.0.120-1.el10_2.noarch.rpm	a55e040b074941832267afcd5639af7774822456b42a65a21124808c80a9b9eb	-	ol10_aarch64_appstream
	tomcat9-el-3.0-api-9.0.120-1.el10_2.noarch.rpm	beee81627d39267eec62c956517dd3b4fe38909e4c03edc482c29c2e1ef85e8a	-	ol10_aarch64_appstream
	tomcat9-jsp-2.3-api-9.0.120-1.el10_2.noarch.rpm	315de73b3c7f3524ee410a47a053925b08048181a27101bf949eb6453e47a7a9	-	ol10_aarch64_appstream
	tomcat9-lib-9.0.120-1.el10_2.noarch.rpm	8574e681b5678e1241ef763723fd9f74c11c932f37b9bb94000c5a25b3a87526	-	ol10_aarch64_appstream
	tomcat9-servlet-4.0-api-9.0.120-1.el10_2.noarch.rpm	113df1c56d02df01f84151abae5449d0a89a76a5d4d4e1ad9bb6d3526dde4ed0	-	ol10_aarch64_appstream
	tomcat9-webapps-9.0.120-1.el10_2.noarch.rpm	6aa7d936a0e69085cafa3e5aac47ec5e0c5f6db35289319cfd657ec60ad2cb6d	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	tomcat9-9.0.120-1.el10_2.src.rpm	b5433d45ebdf074defa9b24f761bcfa6ff6d40b5c3a756a4333a2a253962ea4e	-	ol10_x86_64_appstream
	tomcat9-9.0.120-1.el10_2.noarch.rpm	8c4d8d86e51dd3a147e3de1af19b01e215cfb0ef6439ce0598c3fe8bbb1cc882	-	ol10_x86_64_appstream
	tomcat9-admin-webapps-9.0.120-1.el10_2.noarch.rpm	d944a2cab375da633da4c1aecc5ee3cb6f6b35ed48f49a8c3e32123016e94dba	-	ol10_x86_64_appstream
	tomcat9-docs-webapp-9.0.120-1.el10_2.noarch.rpm	a55e040b074941832267afcd5639af7774822456b42a65a21124808c80a9b9eb	-	ol10_x86_64_appstream
	tomcat9-el-3.0-api-9.0.120-1.el10_2.noarch.rpm	beee81627d39267eec62c956517dd3b4fe38909e4c03edc482c29c2e1ef85e8a	-	ol10_x86_64_appstream
	tomcat9-jsp-2.3-api-9.0.120-1.el10_2.noarch.rpm	315de73b3c7f3524ee410a47a053925b08048181a27101bf949eb6453e47a7a9	-	ol10_x86_64_appstream
	tomcat9-lib-9.0.120-1.el10_2.noarch.rpm	8574e681b5678e1241ef763723fd9f74c11c932f37b9bb94000c5a25b3a87526	-	ol10_x86_64_appstream
	tomcat9-servlet-4.0-api-9.0.120-1.el10_2.noarch.rpm	113df1c56d02df01f84151abae5449d0a89a76a5d4d4e1ad9bb6d3526dde4ed0	-	ol10_x86_64_appstream
	tomcat9-webapps-9.0.120-1.el10_2.noarch.rpm	6aa7d936a0e69085cafa3e5aac47ec5e0c5f6db35289319cfd657ec60ad2cb6d	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team