Tomcat Security Update — AlmaLinux 9 (ALSA-2026:93469)

ALSA-2026:93469 updates Apache Tomcat on AlmaLinux 9, fixing seven CVEs (CVE-2026-65182, CVE-2026-65927, CVE-2026-65637, CVE-2026-68569, CVE-2026-65905, CVE-2026-68525, CVE-2026-68763) — led by a security-constraint bypass from improper identity handling. Update the Tomcat module: dnf update tomcat and restart the service; every servlet application on the server inherits the fix.

Critical 9.1 CVSS 2026-11-02

AlmaLinux 9

SharedLicense लाइसेंस के तहत इसका अर्थ

A security-constraint bypass in Tomcat means URL patterns meant to be protected (admin paths, authenticated endpoints) can be reached without the intended role — the access-control layer itself fails open.

Type:

security

Severity:

important

Release date:

2026-11-02

Description:

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
* tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)
* tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637)
* tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)
* tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905)
* tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)
* tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
noarch	tomcat-9.0.121-1.el9_8.noarch.rpm	142078e78867876a55acb0e5e8a7964551ab5e01430522151d50f6d84c53b81c
noarch	tomcat-lib-9.0.121-1.el9_8.noarch.rpm	370a2060d6410233358132cf239cfd1962a8158078dfacf7e60220c7120234e3
noarch	tomcat-admin-webapps-9.0.121-1.el9_8.noarch.rpm	65b51280aed950b192f61c6313cc609c2df58a7e01c1639c9b8048bff07e7759
noarch	tomcat-el-3.0-api-9.0.121-1.el9_8.noarch.rpm	74959b85587f3a63c235370465c2f984c97dcc18b2936869fc18ec6cb3de26af
noarch	tomcat-servlet-4.0-api-9.0.121-1.el9_8.noarch.rpm	845f7561543201b62604b8c20e7ae14be29e822d43dbdb03f755bc74b83afcf6
noarch	tomcat-docs-webapp-9.0.121-1.el9_8.noarch.rpm	9c90aaf347dba41797fed1f27585b295ef3c1cbdabaf49a8de27ae6e95ff749f
noarch	tomcat-webapps-9.0.121-1.el9_8.noarch.rpm	c0499af6fe9c859278c3fda9dc27ad0760b84e9057cd8ac517770f8a2fe8ccaf
noarch	tomcat-jsp-2.3-api-9.0.121-1.el9_8.noarch.rpm	c841e9341e43e3d754d0da2787179d00245e3d7be79490540743a4a1274bb40f

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

अक्सर पूछे जाने वाले प्रश्न

What is ALSA-2026:93469?

It is AlmaLinux's Tomcat erratum for AlmaLinux 9, fixing seven CVEs (CVE-2026-65182, CVE-2026-65927, CVE-2026-65637, CVE-2026-68569, CVE-2026-65905, CVE-2026-68525, CVE-2026-68763) — including a security-constraint bypass caused by improper identity handling.

Who is affected?

AlmaLinux 9 servers running Tomcat servlet applications — any deployment relying on Tomcat's security constraints to protect admin or private endpoints is directly concerned by the bypass fix.

How do I apply the fix?

Run dnf update tomcat* within the Tomcat module and restart the Tomcat service; verify deployed applications still function after the restart.

What does a security-constraint bypass mean in practice?

URLs configured as protected (requiring a role or authentication) become reachable without those checks — an attacker maps the protected paths and reads or manipulates them anonymously.

संदर्भ

सुरक्षा सलाह

अपने सिस्टम में भेद्यताओं की जाँच करें

अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।

अपना सिस्टम जाँचें

अक्सर पूछे जाने वाले प्रश्न

संबंधित सलाह

अपने सिस्टम में भेद्यताओं की जाँच करें