ELSA-2026-92869

ELSA-2026-92869 - tomcat security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-29

Description

[1:9.0.121-1]
- Resolves: RHEL-255793
tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
- Resolves:
Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183)
- Resolves: RHEL-271822
tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637)
- Resolves: RHEL-271900
tomcat: Limited replay attack possible with DIGEST authentication (CVE-2026-65905)
- Resolves: RHEL-271775
tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)
- Resolves:
DoS in WebSocket chat example (CVE-2026-66299)
- Resolves:
Servlet role references can bypass declarative role constraints (CVE-2026-66422)
- Resolves: RHEL-271798
tomcat: Unauthorized resource access via FORM authentication bypass(CVE-2026-68525)
- Resolves: RHEL-271749
tomcat: Principal lookup could fail open in some cases (CVE-2026-68569)
- Resolves:
Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)
- Resolves:
Default to Moderate (Impact missing upstream) (CVE-2026-73180)

Related CVEs

CVE-2026-65182

CVE-2026-65637

CVE-2026-65905

CVE-2026-65927

CVE-2026-68525

CVE-2026-68569

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	tomcat-9.0.121-1.el8_10.src.rpm	9068ee66aa25ad2f57030a0e26058df430fe40651ac4022e2f2cdb77ee75ea5d	-	ol8_aarch64_appstream
	tomcat-9.0.121-1.el8_10.noarch.rpm	07a0ccc2437ad15e0d7e3a6de4773ded1dd6ddc2ca981890dfb333a2437a4e5e	-	ol8_aarch64_appstream
	tomcat-admin-webapps-9.0.121-1.el8_10.noarch.rpm	cada7641f033d8fda328a2f410ea58fdde6337f2e190f681050fbda50e3ec5ab	-	ol8_aarch64_appstream
	tomcat-docs-webapp-9.0.121-1.el8_10.noarch.rpm	7d9bab6e389ba4f84c7af9d39f35638ae5c0f145f87b082572f0e4320f2ffcbc	-	ol8_aarch64_appstream
	tomcat-el-3.0-api-9.0.121-1.el8_10.noarch.rpm	d84288e1ee16b8f9f3922d6c52180ab50c72f87c939fbdf120547f9c8535491d	-	ol8_aarch64_appstream
	tomcat-jsp-2.3-api-9.0.121-1.el8_10.noarch.rpm	3695810c2c84c1273823f9aa4b0b45be13d9e8b53ba25720e820f0b57646a93b	-	ol8_aarch64_appstream
	tomcat-lib-9.0.121-1.el8_10.noarch.rpm	34cc659e3f56cb1d523a2b193d2a35203ed9c0efa8f09a311b24062438285e96	-	ol8_aarch64_appstream
	tomcat-servlet-4.0-api-9.0.121-1.el8_10.noarch.rpm	5a60367c273ee35c75ab9d1202ea0b8d9401b49e9ad13ea07c9ed19ebd924d48	-	ol8_aarch64_appstream
	tomcat-webapps-9.0.121-1.el8_10.noarch.rpm	a83696b738684cad4819f869d27f8beae95ba306139081d5b0580270fb7c31b6	-	ol8_aarch64_appstream
Oracle Linux 8 (x86_64)	tomcat-9.0.121-1.el8_10.src.rpm	9068ee66aa25ad2f57030a0e26058df430fe40651ac4022e2f2cdb77ee75ea5d	-	ol8_x86_64_appstream
	tomcat-9.0.121-1.el8_10.noarch.rpm	07a0ccc2437ad15e0d7e3a6de4773ded1dd6ddc2ca981890dfb333a2437a4e5e	-	ol8_x86_64_appstream
	tomcat-admin-webapps-9.0.121-1.el8_10.noarch.rpm	cada7641f033d8fda328a2f410ea58fdde6337f2e190f681050fbda50e3ec5ab	-	ol8_x86_64_appstream
	tomcat-docs-webapp-9.0.121-1.el8_10.noarch.rpm	7d9bab6e389ba4f84c7af9d39f35638ae5c0f145f87b082572f0e4320f2ffcbc	-	ol8_x86_64_appstream
	tomcat-el-3.0-api-9.0.121-1.el8_10.noarch.rpm	d84288e1ee16b8f9f3922d6c52180ab50c72f87c939fbdf120547f9c8535491d	-	ol8_x86_64_appstream
	tomcat-jsp-2.3-api-9.0.121-1.el8_10.noarch.rpm	3695810c2c84c1273823f9aa4b0b45be13d9e8b53ba25720e820f0b57646a93b	-	ol8_x86_64_appstream
	tomcat-lib-9.0.121-1.el8_10.noarch.rpm	34cc659e3f56cb1d523a2b193d2a35203ed9c0efa8f09a311b24062438285e96	-	ol8_x86_64_appstream
	tomcat-servlet-4.0-api-9.0.121-1.el8_10.noarch.rpm	5a60367c273ee35c75ab9d1202ea0b8d9401b49e9ad13ea07c9ed19ebd924d48	-	ol8_x86_64_appstream
	tomcat-webapps-9.0.121-1.el8_10.noarch.rpm	a83696b738684cad4819f869d27f8beae95ba306139081d5b0580270fb7c31b6	-	ol8_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team