Oracle Errata System Oracle Linux 5.11 2026-09-18T10:17:42 Oracle Linux 9 [1:9.0.120-1] - Resolves: RHEL-192825 HTTP/2 request headers not validated (CVE-2026-41293) - Resolves: RHEL-192659 Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) - Resolves: RHEL-219565 Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) - Resolves: RHEL-219573 Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084) - Resolves: RHEL-238189 tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498) - Resolves: RHEL-238247 tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) - Resolves: RHEL-238277 tomcat: Improper Authorization allows security bypass (CVE-2026-43515) - Resolves: RHEL-238302 tomcat: Authentication bypass via digest authentication (CVE-2026-43512) - Related: RHEL-183992 Remove tomcat clustering JAR from RPM builds [1:9.0.110-1] - Resolves: RHEL-148687 Update to 9.0.110 and compile with Java 25 to enable FFM features for PQC support [1:9.0.87-7] - Resolves: RHEL-124516 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) - Resolves: RHEL-132561 tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651) [1:9.0.87-6] - Resolves: RHEL-102201 tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames (CVE-2025-48989) [1:9.0.87-5] - Resolves: RHEL-108489 tomcat: Apache Commons FileUpload DOS via part headers (CVE-2025-48976) - Resolves: RHEL-108497 tomcat: Dos in multipart upload (CVE-2025-48988) - Resolves: RHEL-108505 tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125) - Resolves: RHEL-108513 tomcat: Denial of service (CVE-2025-52434) - Resolves: RHEL-108529 tomcat: Denial of service (CVE-2025-52520) - Resolves: RHEL-108523 tomcat: Denial of service (CVE-2025-53506) [1:9.0.87-4] - Resolves: RHEL-91763 tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650) - Resolves: RHEL-71985 tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337) [1:9.0.87-3] - Resolves: RHEL-82945 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) - Resolves: RHEL-71723 tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379) [1:9.0.87-2] - Resolves: RHEL-46163 tomcat: Improper Handling of Exceptional Conditions (CVE-2024-34750) - Resolves: RHEL-18245 - OpenJDK 21 support for RHEL Tomcat MODERATE Copyright 2026 Oracle, Inc. CVE-2026-32990 CVE-2026-41293 CVE-2026-42498 CVE-2026-43512 CVE-2026-43513 CVE-2026-43515 CVE-2026-59083 CVE-2026-59084 cpe:/a:oracle:linux:9::appstream