Back Linuxsecurity

Fedora 35 tomcat14 Major Security Patch SUSE-SU-2026-0891

Linuxsecurity •LinuxSecurity Advisories • March 12, 2026

This update for tomcat11 fixes the following issues: Update to Tomcat 11.0.18: * CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371). * CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385). * CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387). Changelog: * Catalina * Fix: 69932: Fix request end access log pattern regression, which would log the start time of the request instead. (remm) * Fix: 69623: Additional fix for the long standing regression that meant that calls to ClassLoader.getResource().getContent() failed when made from within a web application with resource caching enabled if the target resource was packaged in a JAR file. (markt) * Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the CsrfPreventionFilter. (schultz) * Fix: 69918: Ensure request parameters are correctly parsed for

## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2026-877=1 openSUSE-SLE-15.6-2026-877=1 * Web and Scripting Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-877=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-877=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-877=1

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

zypper in -t patch SUSE-2026-877=1 openSUSE-SLE-15.6-2026-877=1

* Web and Scripting Module 15-SP7

zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-877=1

* SUSE Linux Enterprise Server 15 SP6 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-877=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-877=1

* openSUSE Leap 15.6 (noarch) * tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 * tomcat11-embed-11.0.18-150600.13.15.1 * tomcat11-admin-webapps-11.0.18-150600.13.15.1 * tomcat11-11.0.18-150600.13.15.1 * tomcat11-el-6_0-api-11.0.18-150600.13.15.1 * tomcat11-doc-11.0.18-150600.13.15.1 * tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 * tomcat11-docs-webapp-11.0.18-150600.13.15.1 * tomcat11-jsvc-11.0.18-150600.13.15.1 * tomcat11-lib-11.0.18-150600.13.15.1 * tomcat11-webapps-11.0.18-150600.13.15.1 * Web and Scripting Module 15-SP7 (noarch) * tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 * tomcat11-admin-webapps-11.0.18-150600.13.15.1 * tomcat11-11.0.18-150600.13.15.1 * tomcat11-el-6_0-api-11.0.18-150600.13.15.1 * tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 * tomcat11-lib-11.0.18-150600.13.15.1 * tomcat11-webapps-11.0.18-150600.13.15.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch) * Read the Full Advisory

* openSUSE Leap 15.6 (noarch)

* tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1

* tomcat11-embed-11.0.18-150600.13.15.1

* tomcat11-admin-webapps-11.0.18-150600.13.15.1

* tomcat11-11.0.18-150600.13.15.1

* tomcat11-el-6_0-api-11.0.18-150600.13.15.1

* tomcat11-doc-11.0.18-150600.13.15.1

* tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1

* tomcat11-docs-webapp-11.0.18-150600.13.15.1

* tomcat11-jsvc-11.0.18-150600.13.15.1

* tomcat11-lib-11.0.18-150600.13.15.1

* tomcat11-webapps-11.0.18-150600.13.15.1