Tomcat9 Update Security Update — AlmaLinux 10 (ALSA-2026:25341)
ALSA-2026:25341 updates tomcat9 on AlmaLinux 10, resolving 9 CVEs — the listed flaws (CVE-2025-66614, CVE-2026-24733). Apply the errata with dnf; service restarts where the component runs as one.
Was das unter einer SharedLicense-Lizenz bedeutet
tomcat9 on AlmaLinux 10 is the exposure surface; the advisory's own severity data tops out at CVSS 9.1 (CWE-20).
Type:
security
Severity:
important
Release date:
2026-10-26
Description:
Certificate revocation bypass due to improper OCSP response validation
References:
- CVE-2025-66614 tomcat: Client certificate verification bypass due to virtual host mapping
- CVE-2026-24733 tomcat: security constraint bypass with HTTP/0.9
- CVE-2026-29145 Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration
- CVE-2026-34487 Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files
- CVE-2026-25854 Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve
- CVE-2026-24880 Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension
- CVE-2026-34500 Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration
- CVE-2026-34483 Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve
- CVE-2025-66614
- CVE-2026-24733
- CVE-2026-24734
- CVE-2026-24880
- CVE-2026-25854
- CVE-2026-29145
- CVE-2026-34483
- CVE-2026-34487
- CVE-2026-34500
- RHSA-2026:25341
- ALSA-2026:25341
Updated packages listed below:
| Architecture | Package | Checksum |
| noarch | tomcat9-9.0.117-1.el10_2.alma.1.noarch.rpm | 05aa3bf0312387311b2ebee667eac72d7e7edec61d6304c2887bb89dce956ef9 |
| noarch | tomcat9-lib-9.0.117-1.el10_2.alma.1.noarch.rpm | 112016e28c5036aafd2dc2c8c1106032281ee655ecf0ed4660e6a407a2be6530 |
| noarch | tomcat9-servlet-4.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm | 20c189635df0064ff555758bfe0c95f21fb6875882b9d0af0d6a358047d9cf2b |
| noarch | tomcat9-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm | 4c2a31f2ac55f524c85ddedcf6348fb52bf25e3a8c51aa42bd636a679bc061ba |
| noarch | tomcat9-docs-webapp-9.0.117-1.el10_2.alma.1.noarch.rpm | 69e8e77be4f060182be8e233a029cdac2dc6d78e5dede107e51f129760e53834 |
| noarch | tomcat9-jsp-2.3-api-9.0.117-1.el10_2.alma.1.noarch.rpm | 8f03c1fb22b9b899ba5241ba26943941828f4092d11c3bf45acdfe457b177f1b |
| noarch | tomcat9-admin-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm | cc3072eda709f80d8c5d5b108fe2a57d3bcc068e817a6dad877191d45431c79c |
| noarch | tomcat9-el-3.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm | e88ff8acc2245391a6ac44a4bfd50bed1fb73d897208fbb93ff98452651fb8d6 |
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.
Häufig gestellte Fragen
What does ALSA-2026:25341 fix?
Which release is covered?
How do I apply it?
System auf Schwachstellen prüfen
Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.
System prüfen