Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@9.0.123
purl pkg:apache/tomcat@9.0.123
This package is not known to be subject of any advisories.
Vulnerabilities fixed by this package (7)
Advisory Summary Aliases
CVE-2026-101296
Important: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
CVE-2026-101356
Important: HTTP/2 request/response mix-up after error during async processing
CVE-2026-74048
Low: OpenSSL-FFM FIPS failure does not prevent start-up
CVE-2026-74049
Low: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
CVE-2026-80353
Low: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
CVE-2026-88041
Low: HTTP/2 trailer header cross-contamination
CVE-2026-93446
Low: Possible TLS 1.3 connection failures