<div class="container">
<h1>Security update for tomcat</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:5116-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-11-05T11:56:33Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286361">bsc#1286361</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286362">bsc#1286362</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286502">bsc#1286502</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286555">bsc#1286555</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286559">bsc#1286559</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286571">bsc#1286571</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286902">bsc#1286902</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-101296.html">CVE-2026-101296</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-101356.html">CVE-2026-101356</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-74048.html">CVE-2026-74048</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-74049.html">CVE-2026-74049</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-80353.html">CVE-2026-80353</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-88041.html">CVE-2026-88041</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-93446.html">CVE-2026-93446</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-101296</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-101296</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-101296</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-101356</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-101356</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-101356</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-74048</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-74048</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-74048</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-74049</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-74049</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-74049</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-80353</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.8</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-80353</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.6</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-80353</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-88041</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-88041</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-88041</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-93446</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-93446</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-93446</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 15 SP4</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 15 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing LTSS 15 SP4</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing LTSS 15 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP4</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP4 LTSS</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP5 LTSS</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP6</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP6 LTSS</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP7</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP4</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP6</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP7</li>
<li class="list-group-item">Web and Scripting Module 15-SP7</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves seven vulnerabilities can now be installed.</p>
<h2>Description:</h2>
<p>This update for tomcat fixes the following issues:</p>
<ul>
<li>CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure (bsc#1286502).</li>
<li>CVE-2026-74049: Jasper JSTL <c:redirect> plug-in implementation omits page abort (bsc#1286555).</li>
<li>CVE-2026-80353: TOCTOU when creating unix domain sockets for the APR/Native connector allows an unauthorized local
user to access the unix domain socket (bsc#1286902).</li>
<li>CVE-2026-88041: Information disclosure via incomplete HTTP trailer cleanup (bsc#1286559).</li>
<li>CVE-2026-93446: Possible TLS 1.3 connection failures (bsc#1286571).</li>
<li>CVE-2026-101296: Authentication bypass via non-GSSAPI SASL in JNDI realm (bsc#1286361).</li>
<li>CVE-2026-101356: Information disclosure via incorrect object recycling in HTTP/2 processing (bsc#1286362).</li>
</ul>
<p>Changes for tomcat:</p>
<p>Update to Tomcat 9.0.123:</p>
<ul>
<li>Catalina<ul>
<li>Fix: When starting a web application, don't try and use the web
application class loader until after the web application class loader
has started. (markt)</li>
<li>Fix: various concurrency issues around adding and removing Realms from a
CombinedRealm, in particular doing so while the CombinedRealm is in use.
Note that once a Realm instance has been removed from a CombinedRealm
instance at run-time, the removed Realm instance may not be reused apart
from re-adding it to the same CombinedRealm. (markt)</li>
<li>Update: When StoreConfig re-writes an existing server.xml or context
configuration file, preserve the layout of the existing file (comments,
blank lines and attribute order) on a best effort basis. (remm)</li>
<li>Fix: Track in StandardContext whether the context was deployed from a
Context element in server.xml. Use it to have StoreConfig save to a new
config file. (remm)</li>
<li>Fix: Improve error handling on start-up. (markt)</li>
<li>Fix: byte range responses generated by DefaultServlet so a short
resource stream read does not truncate the response. Treat a premature
end of stream as an I/O error. Based on pull request #1067 by aoto-tech.
(markt)</li>
<li>Fix: Align OpenSSLLifecycleListener with AprLifecycleListener and throw
an Error when FIPS is requested but not available. (markt)</li>
<li>Fix: Ensure that, as per the documentation, a simple bind is always used
when the JNDI realm binds using the user provided name and password to
authenticate the user. (markt)</li>
<li>Update: Optimize Accept-Language header processing and use of resource
budles for localization. (remm)</li>
</ul>
</li>
<li>Coyote<ul>
<li>Fix: 70236: Fix a stalled TLS handshake with the OpenSSL based
implementations of SSLEngine when the first flight of handshake messages
sent by the server is too large to fit in the buffer used by the BIO
pair. Patch submitted by Lukas Hellebrandt. (remm)</li>
<li>Fix: #1073: Fix possible corruption when using HTTP/2 and async IO on
uploads. Submitted by Tim Burke. (remm)</li>
<li>Fix: Avoid very rare race between async write notification and
completion. Skip the write notification in these cases since it would be
useless. (remm)</li>
<li>Fix: a timing issue that could cause large non-blocking writes to stall
for AJP connections. (markt)</li>
<li>Fix: Ensure that the non-blocking write buffer is empty before sending
an AJP end response message. (markt)</li>
<li>Fix: CharChunk.indexOf(char) so that it searches from the start of the
chunk rather than from twice the chunk's start offset when the chunk
does not begin at the start of its buffer. (breken-ai)</li>
<li>Fix: 70247: Fix a leak in the HTTP/2 connection flow control window when
part of the HTTP request body is received but not read. Based on a patch
provided by Guillaume Darmont. (markt)</li>
<li>Fix: 70251: Avoid closing a JarFile in CloseableURLConnection unless it
is certain the JAR is not shared. (remm)</li>
<li>Fix: possible corruption of HTTP/1.1 chunked response bodies if a
previous write to a chunked body fails. (markt)</li>
<li>Fix: Align cipher order with the results produced by OpenSSL if the
cipher specification adds, removes and then re-adds ciphers. (markt)</li>
<li>Add: new attributes (unixDomainSocketParentPermissions and
unixDomainSocketParentOwner) to the APR/Native connector to provide
additional control over the security of Unix Domain Sockets. Additional
checks (enabled by default) have also been added for the directory where
the Unix Domain Socket will be created.(markt)</li>
<li>Fix: Correct a narrow race condition when processing HTTP/2 headers.
(markt)</li>
<li>Fix: possible TLS connections failures caused by one of the flags Tomcat
uses to track TLS handshake progress not being correctly reset. (markt)</li>
<li>Fix: Allow for absolute host names in SNI checks. (markt)</li>
<li>Fix: Correct a gap in asynchronous error handling that could lead to
unexpected IllegalStateExceptions for some error conditions. (markt)</li>
<li>Add: Harden HTTP/2 against applications that do not correctly handle
asynchronous errors. (markt)</li>
</ul>
</li>
<li>Jasper<ul>
<li>Fix: Route JspC servlet context logging through Ant when used as an Ant
task. (sainadh777)</li>
<li>Fix: the tag plugin for the JSTL c:redirtect tag so that page
processing ends with the redirect. (markt)</li>
</ul>
</li>
<li>Web applications<ul>
<li>Add: Documentation: Explicitly state that virtual host matching via the
HTTP host header and TLS configuration matching via SNI are completely
separate processes. (markt)</li>
<li>Fix: Examples: Draw axis-aligned rectangles and ellipses as lines in the
WebSocket drawboard. (sainadh777)</li>
</ul>
</li>
<li>Other<ul>
<li>Update: the internal fork of Apache Commons BCEL to 6.13.0. (markt)</li>
<li>Update: to NSIS 3.13. (markt)</li>
<li>Update: to Byte Buddy 1.18.14. (markt)</li>
<li>Update: to Bouncy Castle 1.8.6. (markt)</li>
<li>Add: Improvements to French translations. (remm)</li>
<li>Add: Improvements to Japanese translations provided by tak7iji. (markt)</li>
</ul>
</li>
<li>Cluster<ul>
<li>Fix: Replicate SSO session key set changes made by removeSession() and
sessionChangedId() in ClusterSingleSignOn so that SSO entries are
correctly deregistered and removed from all nodes when the last
associated session expires, even when the sessions expire on different
cluster nodes. (remm)</li>
<li>Fix: Move context attributes that were set while the web application was
still starting into the replicated attribute map when it is installed in
ReplicatedContext, so that they are replicated to the other nodes like
attributes set later on rather than remaining local to the node that
started the application. (remm)</li>
<li>Fix: a possible deadlock in DeltaSession.expire(): the final session
delta is now captured and sent to the cluster before the session monitor
is acquired, because obtaining the delta takes the delta lock and code
that runs while the delta lock is held, such as session attribute
listener notifications, may in turn wait for the session monitor. (remm)</li>
<li>Fix: Fire the documented send_message_failure lifecycle event with the
message, destination and exception when a SimpleTcpCluster message send
fails and notifyLifecycleListenerOnFailure is enabled. The event was
previously declared but never fired. (remm)</li>
<li>Fix: a possible deadlock in DeltaSession: session attribute listeners
are no longer called while the delta lock is held when attributes are
set or removed. The delta lock is only held while the change is
recorded. (markt)</li>
<li>Fix: a possible deadlock in DeltaSession: received session deltas are
now read into a separate DeltaRequest from the one the session uses to
record local changes. This avoids having to hold the delta lock while
processing received changes. (markt)</li>
<li>Fix: Move context attributes that were set while the web application was
still starting into the replicated attribute map when it is installed in
ReplicatedContext, so that they are replicated to the other nodes like
attributes set later on rather than remaining local to the node that
started the application. (remm)</li>
<li>Fix: an issue replicating SessionListener additions and removals that
meant some modification were not replicated leading to inconsistent
listener configurations across the cluster. (markt)</li>
</ul>
</li>
<li>Tribes<ul>
<li>Docs: Document Tribes channel, membership, transport and replication
status available through JMX. Based on pull request #1071 by sainadh777.
(markt)</li>
</ul>
</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP Applications 15 SP4
<br/>
<code>zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-5116</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
<br/>
<code>zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-5116</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
<br/>
<code>zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-5116</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP Applications 15 SP5
<br/>
<code>zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-5116</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
<br/>
<code>zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-5116</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
<br/>
<code>zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-5116</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP Applications 15 SP6
<br/>
<code>zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-5116</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server 15 SP4 LTSS
<br/>
<code>zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-5116</code>
</li>
<li class="list-group-item">
Web and Scripting Module 15-SP7
<br/>
<code>zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-5116</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server 15 SP5 LTSS
<br/>
<code>zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-5116</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server 15 SP6 LTSS
<br/>
<code>zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-5116</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)
<ul>
<li>tomcat-9.0.123-150200.126.1</li>
<li>tomcat-lib-9.0.123-150200.126.1</li>
<li>tomcat-webapps-9.0.123-150200.126.1</li>
<li>tomcat-admin-webapps-9.0.123-150200.126.1</li>
<li>tomcat-el-3_0-api-9.0.123-150200.126.1</li>
<li>tomcat-jsp-2_3-api-9.0.123-150200.126.1</li>
<li>tomcat-servlet-4_0-api-9.0.123-150200.126.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)
<ul>
<li>tomcat-9.0.123-150200.126.1</li>
<li>tomcat-lib-9.0.123-150200.126.1</li>
<li>tomcat-webapps-9.0.123-150200.126.1</li>
<li>tomcat-admin-webapps-9.0.123-150200.126.1</li>
<li>tomcat-el-3_0-api-9.0.123-150200.126.1</li>
<li>tomcat-jsp-2_3-api-9.0.123-150200.126.1</li>
<li>tomcat-servlet-4_0-api-9.0.123-150200.126.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)
<ul>
<li>tomcat-9.0.123-150200.126.1</li>
<li>tomcat-lib-9.0.123-150200.126.1</li>
<li>tomcat-webapps-9.0.123-150200.126.1</li>
<li>tomcat-admin-webapps-9.0.123-150200.126.1</li>
<li>tomcat-el-3_0-api-9.0.123-150200.126.1</li>
<li>tomcat-jsp-2_3-api-9.0.123-150200.126.1</li>
<li>tomcat-servlet-4_0-api-9.0.123-150200.126.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch)
<ul>
<li>tomcat-9.0.123-150200.126.1</li>
<li>tomcat-lib-9.0.123-150200.126.1</li>
<li>tomcat-webapps-9.0.123-150200.126.1</li>
<li>tomcat-admin-webapps-9.0.123-150200.126.1</li>
<li>tomcat-el-3_0-api-9.0.123-150200.126.1</li>
<li>tomcat-jsp-2_3-api-9.0.123-150200.126.1</li>
<li>tomcat-servlet-4_0-api-9.0.123-150200.126.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch)
<ul>
<li>tomcat-9.0.123-150200.126.1</li>
<li>tomcat-lib-9.0.123-150200.126.1</li>
<li>tomcat-webapps-9.0.123-150200.126.1</li>
<li>tomcat-admin-webapps-9.0.123-150200.126.1</li>
<li>tomcat-el-3_0-api-9.0.123-150200.126.1</li>
<li>tomcat-jsp-2_3-api-9.0.123-150200.126.1</li>
<li>tomcat-servlet-4_0-api-9.0.123-150200.126.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch)
<ul>
<li>tomcat-9.0.123-150200.126.1</li>
<li>tomcat-lib-9.0.123-150200.126.1</li>
<li>tomcat-webapps-9.0.123-150200.126.1</li>
<li>tomcat-admin-webapps-9.0.123-150200.126.1</li>
<li>tomcat-el-3_0-api-9.0.123-150200.126.1</li>
<li>tomcat-jsp-2_3-api-9.0.123-150200.126.1</li>
<li>tomcat-servlet-4_0-api-9.0.123-150200.126.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
<ul>
<li>tomcat-9.0.123-150200.126.1</li>
<li>tomcat-lib-9.0.123-150200.126.1</li>
<li>tomcat-webapps-9.0.123-150200.126.1</li>
<li>tomcat-admin-webapps-9.0.123-150200.126.1</li>
<li>tomcat-el-3_0-api-9.0.123-150200.126.1</li>
<li>tomcat-jsp-2_3-api-9.0.123-150200.126.1</li>
<li>tomcat-servlet-4_0-api-9.0.123-150200.126.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 15 SP4 LTSS (noarch)
<ul>
<li>tomcat-9.0.123-150200.126.1</li>
<li>tomcat-lib-9.0.123-150200.126.1</li>
<li>tomcat-webapps-9.0.123-150200.126.1</li>
<li>tomcat-admin-webapps-9.0.123-150200.126.1</li>
<li>tomcat-el-3_0-api-9.0.123-150200.126.1</li>
<li>tomcat-jsp-2_3-api-9.0.123-150200.126.1</li>
<li>tomcat-servlet-4_0-api-9.0.123-150200.126.1</li>
</ul>
</li>
<li>
Web and Scripting Module 15-SP7 (noarch)
<ul>
<li>tomcat-9.0.123-150200.126.1</li>
<li>tomcat-lib-9.0.123-150200.126.1</li>
<li>tomcat-webapps-9.0.123-150200.126.1</li>
<li>tomcat-admin-webapps-9.0.123-150200.126.1</li>
<li>tomcat-el-3_0-api-9.0.123-150200.126.1</li>
<li>tomcat-jsp-2_3-api-9.0.123-150200.126.1</li>
<li>tomcat-servlet-4_0-api-9.0.123-150200.126.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 15 SP5 LTSS (noarch)
<ul>
<li>tomcat-9.0.123-150200.126.1</li>
<li>tomcat-lib-9.0.123-150200.126.1</li>
<li>tomcat-webapps-9.0.123-150200.126.1</li>
<li>tomcat-admin-webapps-9.0.123-150200.126.1</li>
<li>tomcat-el-3_0-api-9.0.123-150200.126.1</li>
<li>tomcat-jsp-2_3-api-9.0.123-150200.126.1</li>
<li>tomcat-servlet-4_0-api-9.0.123-150200.126.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
<ul>
<li>tomcat-9.0.123-150200.126.1</li>
<li>tomcat-lib-9.0.123-150200.126.1</li>
<li>tomcat-webapps-9.0.123-150200.126.1</li>
<li>tomcat-admin-webapps-9.0.123-150200.126.1</li>
<li>tomcat-el-3_0-api-9.0.123-150200.126.1</li>
<li>tomcat-jsp-2_3-api-9.0.123-150200.126.1</li>
<li>tomcat-servlet-4_0-api-9.0.123-150200.126.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-101296.html">https://www.suse.com/security/cve/CVE-2026-101296.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-101356.html">https://www.suse.com/security/cve/CVE-2026-101356.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-74048.html">https://www.suse.com/security/cve/CVE-2026-74048.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-74049.html">https://www.suse.com/security/cve/CVE-2026-74049.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-80353.html">https://www.suse.com/security/cve/CVE-2026-80353.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-88041.html">https://www.suse.com/security/cve/CVE-2026-88041.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-93446.html">https://www.suse.com/security/cve/CVE-2026-93446.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286361">https://bugzilla.suse.com/show_bug.cgi?id=1286361</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286362">https://bugzilla.suse.com/show_bug.cgi?id=1286362</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286502">https://bugzilla.suse.com/show_bug.cgi?id=1286502</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286555">https://bugzilla.suse.com/show_bug.cgi?id=1286555</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286559">https://bugzilla.suse.com/show_bug.cgi?id=1286559</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286571">https://bugzilla.suse.com/show_bug.cgi?id=1286571</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286902">https://bugzilla.suse.com/show_bug.cgi?id=1286902</a>
</li>
</ul>
</div>