Back Linuxsecurity

SUSE Tomcat Important Security Update for Seven Issues 2026-2299

Linuxsecurity •LinuxSecurity Advisories • June 8, 2026

## This update for tomcat fixes the following issues Update to Tomcat 9.0.118: * CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162). * CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163). * CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165). * CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145). * CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166). * CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167). * CVE-2026-43515: Security constraints not correctly applied (bsc#1265168). Changes: * Catalina * Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and

* CVE-2026-41284 ( SUSE ): 7.1

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-41284 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-41284 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-41293 ( SUSE ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-41293 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-41293 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-42498 ( SUSE ): 6.9

Announcement ID: SUSE-SU-2026:2299-1 Release Date: 2026-06-08T10:55:17Z Rating: important

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Tomcat Vulnerabilities Affecting Multiple Ubuntu Releases On June 10, 2026, Ubuntu released USN-8417-1, addressing multiple vulnerabilities in Tomcat, including denial of service and authentication bypass issues. The vulnerabilities affect various Ubuntu versions, including 26.04 LTS and earlier releases. Key vulnerabilities include CVE-2026-41284, which allows excessive memory consumption through WebDAV requests, and CVE-2026-41293, which involves improper validation of HTTP/2 headers leading to potential crashes or arbitrary code execution. Other vulnerabilities include CVE-2026-42498, exposing sensitive credentials during WebSocket upgrades, and CVE-2026-43512, allowing unauthorized authentication. Administrators are advised to update their systems to mitigate these risks. The vulnerabilities were disclosed on May 12, 2026, and are considered critical due to their potential impact on system security. 16 sources 73

Extracted Entities

SUSE Tomcat Important Security Update for Seven Issues 2026-2299

The full story

Extracted Entities

CVEs (7)

CWE Weaknesses (4)

Platforms (1)