Back Linuxsecurity

Oracle Tomcat Important Security Fixes Advisory ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • July 28, 2026

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

[1:9.0.117-2] - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds [1:9.0.117-1] - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVE-2026-34500) - Resolves: Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token (CVE-2026-34487) - Resolves: Tomcat: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor (CVE-2026-34486) - Resolves: Tomcat: Incomplete escaping of JSON access logs (CVE-2026-34483) - Resolves: Tomcat: The fix for CVE-2025-66614 was incomplete (CVE-2026-32990) - Resolves: Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default (CVE-2026-29146) - Resolves: Tomcat: OCSP checks sometimes soft-fail even when soft-fail is disabled (CVE-2026-29145) - Resolves: Tomcat: Configured TLS cipher preference order not pre...

tomcat9-9.0.117-2.el10_2.noarch.rpm tomcat9-admin-webapps-9.0.117-2.el10_2.noarch.rpm tomcat9-docs-webapp-9.0.117-2.el10_2.noarch.rpm tomcat9-el-3.0-api-9.0.117-2.el10_2.noarch.rpm tomcat9-jsp-2.3-api-9.0.117-2.el10_2.noarch.rpm tomcat9-lib-9.0.117-2.el10_2.noarch.rpm tomcat9-servlet-4.0-api-9.0.117-2.el10_2.noarch.rpm tomcat9-webapps-9.0.117-2.el10_2.noarch.rpm

Related CVEs: CVE-2026-24734

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Tomcat Security Fixes Address Critical Vulnerabilities On July 28, 2026, Oracle released important security fixes for Tomcat versions 9 and 10, addressing multiple vulnerabilities. Key issues include CVE-2026-24734, a certificate revocation bypass, and CVE-2026-29146, which exposes sensitive data due to a padding oracle vulnerability in the EncryptInterceptor. Other vulnerabilities include CVE-2026-34487, which exposes Kubernetes bearer tokens, and CVE-2026-34486, allowing bypass of EncryptInterceptor protections. The vulnerabilities affect users of Apache Tomcat, particularly those running versions 9.0.117 and 10.1.49. Users are advised to audit Linux privileges to limit potential compromise and escalation. The fixes are critical for maintaining data integrity and security across affected systems. 10 sources 71

Extracted Entities

Oracle Tomcat Important Security Fixes Advisory ELSA-2026

The full story

Extracted Entities

CVEs (9)

Platforms (3)

Vulnerabilities (1)