ELSA-2026-92862

ELSA-2026-92862 - tomcat security, bug fix, and enhancement update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-30

Description

[1:10.1.49-5]
- Resolves: RHEL-264918
tomcat: Stalled TLS handshake when the server's first flight is too large
- Resolves: RHEL-255786
tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
- Resolves: RHEL-271888
tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905)
- Resolves: RHEL-271766
tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)
- Resolves: RHEL-271791
tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)
- Resolves: RHEL-271741
tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)
- Resolves: RHEL-271720
tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)

Related CVEs

CVE-2026-65182

CVE-2026-65905

CVE-2026-65927

CVE-2026-68525

CVE-2026-68569

CVE-2026-68763

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	tomcat-10.1.49-5.el10_2.src.rpm	1c27e2ba891d3d71a266ca77b3903c76ec74af2adcaab5e94e4fa134e41ade1b	-	ol10_aarch64_appstream
	tomcat-10.1.49-5.el10_2.noarch.rpm	5df13d2b94570eb8f3245ef0f71e9e27586c9f34452657e0ee981bd8a72643d1	-	ol10_aarch64_appstream
	tomcat-admin-webapps-10.1.49-5.el10_2.noarch.rpm	900a633f308700d04d409103066f16cb3a4d5af65044e69bceb5c15af72160f6	-	ol10_aarch64_appstream
	tomcat-docs-webapp-10.1.49-5.el10_2.noarch.rpm	bf3a59ee7db5eb7974b4d0f3303e16a943895d6ea188991fd050c9dd8461b980	-	ol10_aarch64_appstream
	tomcat-el-5.0-api-10.1.49-5.el10_2.noarch.rpm	a4d6674b3e7cf2510a64d1e04582fac62d2f174e7b9dfbd4ad911af0ebe69607	-	ol10_aarch64_appstream
	tomcat-jsp-3.1-api-10.1.49-5.el10_2.noarch.rpm	55da75b7edfd1ebe3219104ae6b1960b793ecc217f54149c9f5584afec03850d	-	ol10_aarch64_appstream
	tomcat-lib-10.1.49-5.el10_2.noarch.rpm	a31af0995f9624f829a6819e83e4dd9629271af42d1d7a0a810e1db95b724e16	-	ol10_aarch64_appstream
	tomcat-servlet-6.0-api-10.1.49-5.el10_2.noarch.rpm	cc74a4c9edf4636e5fab992eaf68e393e6b7fbbd0572b442ddb7129daf3ee947	-	ol10_aarch64_appstream
	tomcat-webapps-10.1.49-5.el10_2.noarch.rpm	75be2300d8bc06bc523a09570ca9478bb742198b08da640610ae60a52e8634cc	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	tomcat-10.1.49-5.el10_2.src.rpm	1c27e2ba891d3d71a266ca77b3903c76ec74af2adcaab5e94e4fa134e41ade1b	-	ol10_x86_64_appstream
	tomcat-10.1.49-5.el10_2.noarch.rpm	5df13d2b94570eb8f3245ef0f71e9e27586c9f34452657e0ee981bd8a72643d1	-	ol10_x86_64_appstream
	tomcat-admin-webapps-10.1.49-5.el10_2.noarch.rpm	900a633f308700d04d409103066f16cb3a4d5af65044e69bceb5c15af72160f6	-	ol10_x86_64_appstream
	tomcat-docs-webapp-10.1.49-5.el10_2.noarch.rpm	bf3a59ee7db5eb7974b4d0f3303e16a943895d6ea188991fd050c9dd8461b980	-	ol10_x86_64_appstream
	tomcat-el-5.0-api-10.1.49-5.el10_2.noarch.rpm	a4d6674b3e7cf2510a64d1e04582fac62d2f174e7b9dfbd4ad911af0ebe69607	-	ol10_x86_64_appstream
	tomcat-jsp-3.1-api-10.1.49-5.el10_2.noarch.rpm	55da75b7edfd1ebe3219104ae6b1960b793ecc217f54149c9f5584afec03850d	-	ol10_x86_64_appstream
	tomcat-lib-10.1.49-5.el10_2.noarch.rpm	a31af0995f9624f829a6819e83e4dd9629271af42d1d7a0a810e1db95b724e16	-	ol10_x86_64_appstream
	tomcat-servlet-6.0-api-10.1.49-5.el10_2.noarch.rpm	cc74a4c9edf4636e5fab992eaf68e393e6b7fbbd0572b442ddb7129daf3ee947	-	ol10_x86_64_appstream
	tomcat-webapps-10.1.49-5.el10_2.noarch.rpm	75be2300d8bc06bc523a09570ca9478bb742198b08da640610ae60a52e8634cc	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team