SUSE-SU-2026:5073-1: important: Security update for tomcat10
SLE-SECURITY-UPDATES
null at suse.de
Tue Nov 3 16:52:52 UTC 2026
# Security update for tomcat10
Announcement ID: SUSE-SU-2026:5073-1
Release Date: 2026-11-03T08:16:45Z
Rating: important
References:
* bsc#1286361
* bsc#1286362
* bsc#1286502
* bsc#1286555
* bsc#1286559
* bsc#1286571
Cross-References:
* CVE-2026-101296
* CVE-2026-101356
* CVE-2026-74048
* CVE-2026-74049
* CVE-2026-88041
* CVE-2026-93446
CVSS scores:
* CVE-2026-101296 ( SUSE ): 9.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-101296 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-101296 ( NVD ): 9.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-101356 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2026-101356 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-101356 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
* CVE-2026-74048 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-74048 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-74048 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-74049 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2026-74049 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-74049 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-88041 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2026-88041 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-88041 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-93446 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-93446 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-93446 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP5 LTSS
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* Web and Scripting Module 15-SP7
An update that solves six vulnerabilities can now be installed.
## Description:
This update for tomcat10 fixes the following issues:
* CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure
(bsc#1286502).
* CVE-2026-74049: Jasper JSTL <c:redirect> plug-in implementation omits page
abort (bsc#1286555).
* CVE-2026-88041: Information disclosure via incomplete HTTP trailer cleanup
(bsc#1286559).
* CVE-2026-93446: Possible TLS 1.3 connection failures (bsc#1286571).
* CVE-2026-101296: Authentication bypass via non-GSSAPI SASL in JNDI realm
(bsc#1286361).
* CVE-2026-101356: Information disclosure via incorrect object recycling in
HTTP/2 processing (bsc#1286362).
Changes:
Update to Tomcat 10.1.61:
* Catalina
* Fix: When starting a web application, don't try and use the web application
class loader until after the web application class loader has started.
(markt)
* Fix: various concurrency issues around adding and removing Realms from a
CombinedRealm, in particular doing so while the CombinedRealm is in use.
Note that once a Realm instance has been removed from a CombinedRealm
instance at run-time, the removed Realm instance may not be reused apart
from re-adding it to the same CombinedRealm. (markt)
* Update: When StoreConfig re-writes an existing server.xml or context
configuration file, preserve the layout of the existing file (comments,
blank lines and attribute order) on a best effort basis. (remm)
* Fix: Track in StandardContext whether the context was deployed from a
Context element in server.xml. Use it to have StoreConfig save to a new
config file. (remm)
* Fix: Improve error handling on start-up. (markt)
* Fix: byte range responses generated by DefaultServlet so a short resource
stream read does not truncate the response. Treat a premature end of stream
as an I/O error. Based on pull request #1067 by aoto-tech. (markt)
* Fix: Align OpenSSLLifecycleListener with AprLifecycleListener and throw an
Error when FIPS is requested but not available. (markt)
* Fix: Ensure that, as per the documentation, a simple bind is always used
when the JNDI realm binds using the user provided name and password to
authenticate the user. (markt)
* Update: Optimize Accept-Language header processing and use of resource
budles for localization. (remm)
* Coyote
* Fix: 70236: Fix a stalled TLS handshake with the OpenSSL based
implementations of SSLEngine when the first flight of handshake messages
sent by the server is too large to fit in the buffer used by the BIO pair.
Patch submitted by Lukas Hellebrandt. (remm)
* Fix: #1073: Fix possible corruption when using HTTP/2 and async IO on
uploads. Submitted by Tim Burke. (remm)
* Fix: Avoid very rare race between async write notification and completion.
Skip the write notification in these cases since it would be useless. (remm)
* Fix: a timing issue that could cause large non-blocking writes to stall for
AJP connections. (markt)
* Fix: Ensure that the non-blocking write buffer is empty before sending an
AJP end response message. (markt)
* Fix: CharChunk.indexOf(char) so that it searches from the start of the chunk
rather than from twice the chunk's start offset when the chunk does not
begin at the start of its buffer. (breken-ai)
* Fix: 70247: Fix a leak in the HTTP/2 connection flow control window when
part of the HTTP request body is received but not read. Based on a patch
provided by Guillaume Darmont. (markt)
* Fix: 70251: Avoid closing a JarFile in CloseableURLConnection unless it is
certain the JAR is not shared. (remm)
* Fix: possible corruption of HTTP/1.1 chunked response bodies if a previous
write to a chunked body fails. (markt)
* Fix: Align cipher order with the results produced by OpenSSL if the cipher
specification adds, removes and then re-adds ciphers. (markt)
* Fix: Correct a narrow race condition when processing HTTP/2 headers.
* Fix: possible TLS connections failures caused by one of the flags Tomcat
uses to track TLS handshake progress not being correctly reset. (markt)
* Fix: Allow for absolute host names in SNI checks. (markt)
* Fix: Correct a gap in asynchronous error handling that could lead to
unexpected IllegalStateExceptions for some error conditions. (markt)
* Add: Harden HTTP/2 against applications that do not correctly handle
asynchronous errors. (markt)
* Jasper
* Fix: Route JspC servlet context logging through Ant when used as an Ant
task. (sainadh777)
* Fix: the tag plugin for the JSTL <c:redirtect> tag so that page processing
ends with the redirect. (markt)
* Web applications
* Add: Documentation: Explicitly state that virtual host matching via the HTTP
host header and TLS configuration matching via SNI are completely separate
processes. (markt)
* Fix: Examples: Draw axis-aligned rectangles and ellipses as lines in the
WebSocket drawboard. (sainadh777)
* Other
* Update: the internal fork of Apache Commons BCEL to 6.13.0. (markt)
* Update: to NSIS 3.13. (markt)
* Update: to Byte Buddy 1.18.14. (markt)
* Update: to Bouncy Castle 1.8.6. (markt)
* Add: Improvements to French translations. (remm)
* Add: Improvements to Japanese translations provided by tak7iji. (markt)
* Update: to Migration tool for Jakarta EE 1.0.13. (markt)
* Cluster
* Fix: Replicate SSO session key set changes made by removeSession() and
sessionChangedId() in ClusterSingleSignOn so that SSO entries are correctly
deregistered and removed from all nodes when the last associated session
expires, even when the sessions expire on different cluster nodes. (remm)
* Fix: Move context attributes that were set while the web application was
still starting into the replicated attribute map when it is installed in
ReplicatedContext, so that they are replicated to the other nodes like
attributes set later on rather than remaining local to the node that started
the application. (remm)
* Fix: a possible deadlock in DeltaSession.expire(): the final session delta
is now captured and sent to the cluster before the session monitor is
acquired, because obtaining the delta takes the delta lock and code that
runs while the delta lock is held, such as session attribute listener
notifications, may in turn wait for the session monitor. (remm)
* Fix: Fire the documented send_message_failure lifecycle event with the
message, destination and exception when a SimpleTcpCluster message send
fails and notifyLifecycleListenerOnFailure is enabled. The event was
previously declared but never fired. (remm)
* Fix: a possible deadlock in DeltaSession: session attribute listeners are no
longer called while the delta lock is held when attributes are set or
removed. The delta lock is only held while the change is recorded. (markt)
* Fix: a possible deadlock in DeltaSession: received session deltas are now
read into a separate DeltaRequest from the one the session uses to record
local changes. This avoids having to hold the delta lock while processing
received changes. (markt)
* Fix: an issue replicating SessionListener additions and removals that meant
some modification were not replicated leading to inconsistent listener
configurations across the cluster. (markt)
* Tribes
* Docs: Document Tribes channel, membership, transport and replication status
available through JMX. Based on pull request #1071 by sainadh777.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-5073
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-5073
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-5073
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-5073
* Web and Scripting Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-5073
* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-5073
* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-5073
## Package List:
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch)
* tomcat10-lib-10.1.61-150200.5.85.1
* tomcat10-el-5_0-api-10.1.61-150200.5.85.1
* tomcat10-admin-webapps-10.1.61-150200.5.85.1
* tomcat10-servlet-6_0-api-10.1.61-150200.5.85.1
* tomcat10-jsp-3_1-api-10.1.61-150200.5.85.1
* tomcat10-10.1.61-150200.5.85.1
* tomcat10-webapps-10.1.61-150200.5.85.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch)
* tomcat10-lib-10.1.61-150200.5.85.1
* tomcat10-el-5_0-api-10.1.61-150200.5.85.1
* tomcat10-admin-webapps-10.1.61-150200.5.85.1
* tomcat10-servlet-6_0-api-10.1.61-150200.5.85.1
* tomcat10-jsp-3_1-api-10.1.61-150200.5.85.1
* tomcat10-10.1.61-150200.5.85.1
* tomcat10-webapps-10.1.61-150200.5.85.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch)
* tomcat10-lib-10.1.61-150200.5.85.1
* tomcat10-el-5_0-api-10.1.61-150200.5.85.1
* tomcat10-admin-webapps-10.1.61-150200.5.85.1
* tomcat10-servlet-6_0-api-10.1.61-150200.5.85.1
* tomcat10-jsp-3_1-api-10.1.61-150200.5.85.1
* tomcat10-10.1.61-150200.5.85.1
* tomcat10-webapps-10.1.61-150200.5.85.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
* tomcat10-lib-10.1.61-150200.5.85.1
* tomcat10-el-5_0-api-10.1.61-150200.5.85.1
* tomcat10-admin-webapps-10.1.61-150200.5.85.1
* tomcat10-servlet-6_0-api-10.1.61-150200.5.85.1
* tomcat10-jsp-3_1-api-10.1.61-150200.5.85.1
* tomcat10-10.1.61-150200.5.85.1
* tomcat10-webapps-10.1.61-150200.5.85.1
* Web and Scripting Module 15-SP7 (noarch)
* tomcat10-lib-10.1.61-150200.5.85.1
* tomcat10-el-5_0-api-10.1.61-150200.5.85.1
* tomcat10-admin-webapps-10.1.61-150200.5.85.1
* tomcat10-servlet-6_0-api-10.1.61-150200.5.85.1
* tomcat10-jsp-3_1-api-10.1.61-150200.5.85.1
* tomcat10-10.1.61-150200.5.85.1
* tomcat10-webapps-10.1.61-150200.5.85.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (noarch)
* tomcat10-lib-10.1.61-150200.5.85.1
* tomcat10-el-5_0-api-10.1.61-150200.5.85.1
* tomcat10-admin-webapps-10.1.61-150200.5.85.1
* tomcat10-servlet-6_0-api-10.1.61-150200.5.85.1
* tomcat10-jsp-3_1-api-10.1.61-150200.5.85.1
* tomcat10-10.1.61-150200.5.85.1
* tomcat10-webapps-10.1.61-150200.5.85.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
* tomcat10-lib-10.1.61-150200.5.85.1
* tomcat10-el-5_0-api-10.1.61-150200.5.85.1
* tomcat10-admin-webapps-10.1.61-150200.5.85.1
* tomcat10-servlet-6_0-api-10.1.61-150200.5.85.1
* tomcat10-jsp-3_1-api-10.1.61-150200.5.85.1
* tomcat10-10.1.61-150200.5.85.1
* tomcat10-webapps-10.1.61-150200.5.85.1
## References:
* https://www.suse.com/security/cve/CVE-2026-101296.html
* https://www.suse.com/security/cve/CVE-2026-101356.html
* https://www.suse.com/security/cve/CVE-2026-74048.html
* https://www.suse.com/security/cve/CVE-2026-74049.html
* https://www.suse.com/security/cve/CVE-2026-88041.html
* https://www.suse.com/security/cve/CVE-2026-93446.html
* https://bugzilla.suse.com/show_bug.cgi?id=1286361
* https://bugzilla.suse.com/show_bug.cgi?id=1286362
* https://bugzilla.suse.com/show_bug.cgi?id=1286502
* https://bugzilla.suse.com/show_bug.cgi?id=1286555
* https://bugzilla.suse.com/show_bug.cgi?id=1286559
* https://bugzilla.suse.com/show_bug.cgi?id=1286571
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261103/c3de7b87/attachment.htm>
More information about the sle-security-updates
mailing list