Search for packages
| purl | pkg:apache/tomcat@11.0.26 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2026-101296
|
Important: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms |
Not vulnerable |
|
CVE-2026-101356
|
Important: HTTP/2 request/response mix-up after error during async processing |
Not vulnerable |
|
CVE-2026-103119
|
Important: AJP response mix-up |
Not vulnerable |
|
CVE-2026-74048
|
Low: OpenSSL-FFM FIPS failure does not prevent start-up |
Not vulnerable |
|
CVE-2026-74049
|
Low: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) |
Not vulnerable |
|
CVE-2026-88041
|
Low: HTTP/2 trailer header cross-contamination |
Not vulnerable |
|
CVE-2026-93446
|
Low: Possible TLS 1.3 connection failures |
Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2026-73581
|
Moderate: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore | |
|
CVE-2026-75973
|
Low: Cross-context authentication mix-up with Jakarta Authentication configured | |
|
CVE-2026-76183
|
Important: Bypass of security constraints for WebSocket endpoints | |
|
CVE-2026-77756
|
Low: Transfer-Encoding honored for HTTP/1.0 requests | |
|
CVE-2026-77762
|
Low: Stale HPACK emitter injects trailers into recycled pooled Request | |
|
CVE-2026-77791
|
Important: DoS via busy wait during WebSocket close | |
|
CVE-2026-78383
|
Important: AJP DoS via missing request body | |
|
CVE-2026-78437
|
Low: HTTP/2 DoS via malformed request | |
|
CVE-2026-79677
|
Moderate: WebSocket DoS due to lost asynchronous write timeout | |
|
CVE-2026-86248
|
Moderate: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled | |
|
CVE-2026-86350
|
Important: Regression in fix for CVE-2026-41293 can trigger request header mix-up | |
|
CVE-2026-87022
|
Low: WebSocket message smuggling with per-message-deflate |