Tomcat9 Update Security Update — AlmaLinux 10 (ALSA-2026:25341)
ALSA-2026:25341 updates tomcat9 on AlmaLinux 10, resolving 9 CVEs — the listed flaws (CVE-2025-66614, CVE-2026-24733). Apply the errata with dnf; service restarts where the component runs as one.
SharedLicense लाइसेंस के तहत इसका अर्थ
tomcat9 on AlmaLinux 10 is the exposure surface; the advisory's own severity data tops out at CVSS 9.1 (CWE-20).
Type:
security
Severity:
important
Release date:
2026-10-26
Description:
Certificate revocation bypass due to improper OCSP response validation
References:
- CVE-2025-66614 tomcat: Client certificate verification bypass due to virtual host mapping
- CVE-2026-24733 tomcat: security constraint bypass with HTTP/0.9
- CVE-2026-29145 Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration
- CVE-2026-34487 Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files
- CVE-2026-25854 Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve
- CVE-2026-24880 Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension
- CVE-2026-34500 Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration
- CVE-2026-34483 Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve
- CVE-2025-66614
- CVE-2026-24733
- CVE-2026-24734
- CVE-2026-24880
- CVE-2026-25854
- CVE-2026-29145
- CVE-2026-34483
- CVE-2026-34487
- CVE-2026-34500
- RHSA-2026:25341
- ALSA-2026:25341
Updated packages listed below:
| Architecture | Package | Checksum |
| noarch | tomcat9-9.0.117-1.el10_2.alma.1.noarch.rpm | 05aa3bf0312387311b2ebee667eac72d7e7edec61d6304c2887bb89dce956ef9 |
| noarch | tomcat9-lib-9.0.117-1.el10_2.alma.1.noarch.rpm | 112016e28c5036aafd2dc2c8c1106032281ee655ecf0ed4660e6a407a2be6530 |
| noarch | tomcat9-servlet-4.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm | 20c189635df0064ff555758bfe0c95f21fb6875882b9d0af0d6a358047d9cf2b |
| noarch | tomcat9-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm | 4c2a31f2ac55f524c85ddedcf6348fb52bf25e3a8c51aa42bd636a679bc061ba |
| noarch | tomcat9-docs-webapp-9.0.117-1.el10_2.alma.1.noarch.rpm | 69e8e77be4f060182be8e233a029cdac2dc6d78e5dede107e51f129760e53834 |
| noarch | tomcat9-jsp-2.3-api-9.0.117-1.el10_2.alma.1.noarch.rpm | 8f03c1fb22b9b899ba5241ba26943941828f4092d11c3bf45acdfe457b177f1b |
| noarch | tomcat9-admin-webapps-9.0.117-1.el10_2.alma.1.noarch.rpm | cc3072eda709f80d8c5d5b108fe2a57d3bcc068e817a6dad877191d45431c79c |
| noarch | tomcat9-el-3.0-api-9.0.117-1.el10_2.alma.1.noarch.rpm | e88ff8acc2245391a6ac44a4bfd50bed1fb73d897208fbb93ff98452651fb8d6 |
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.
अक्सर पूछे जाने वाले प्रश्न
What does ALSA-2026:25341 fix?
Which release is covered?
How do I apply it?
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें