ELSA-2026-93469

Описание

[1:9.0.121-1]

• Resolves: RHEL-255800 tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
• Resolves: tomcat: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183)
• Resolves: RHEL-271827 tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637)
• Resolves: RHEL-271903 tomcat: Limited replay attack possible with DIGEST authentication (CVE-2026-65905)
• Resolves: RHEL-271776 tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)
• Resolves: tomcat: DoS in WebSocket chat example (CVE-2026-66299)
• Resolves: tomcat: Servlet role references can bypass declarative role constraints (CVE-2026-66422)
• Resolves: RHEL-271800 tomcat: Unauthorized resource access via FORM authentication bypass(CVE-2026-68525)
• Resolves: RHEL-271810 tomcat: Principal lookup could fail open in some cases (CVE-2026-68569)
• Resolves: RHEL-271732 tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)
• Resolves: tomcat: Default to Moderate (Impact missing upstream) (CVE-2026-73180)