Critical Tomcat Vulnerabilities Affecting Multiple Ubuntu Releases

Critical Tomcat Vulnerabilities Affecting Multiple Ubuntu Releases

First seen 10 Jun 2026, 10:17 UTC •LinuxsecurityUbuntulaunchpad.netCybersecuritynews •87% similarity •72.9

Article Content

Browse articles
ThreatCluster

On June 10, 2026, Ubuntu released USN-8417-1, addressing multiple vulnerabilities in Tomcat, including denial of service and authentication bypass issues. The vulnerabilities affect various Ubuntu versions, including 26.04 LTS and earlier releases. Key vulnerabilities include CVE-2026-41284, which allows excessive memory consumption through WebDAV requests, and CVE-2026-41293, which involves improper validation of HTTP/2 headers leading to potential crashes or arbitrary code execution. Other vulnerabilities include CVE-2026-42498, exposing sensitive credentials during WebSocket upgrades, and CVE-2026-43512, allowing unauthorized authentication. Administrators are advised to update their systems to mitigate these risks. The vulnerabilities were disclosed on May 12, 2026, and are considered critical due to their potential impact on system security.

Key Points: • Multiple critical vulnerabilities in Tomcat affect various Ubuntu versions. • CVE-2026-41284 can lead to denial of service through unbounded WebDAV requests. • Immediate updates are required to mitigate risks associated with these vulnerabilities.

ThreatCluster AI

Timeline

2026-05-12
CVE-2026-41284 published
Unbounded read in WebDAV LOCK and PROPFIND handling allows excessive memory consumption.
Linuxsecurity
2026-05-12
CVE-2026-41293 published
Improper validation of HTTP/2 request headers can lead to crashes or arbitrary code execution.
Linuxsecurity
2026-05-12
CVE-2026-42498 published
WebSocket authentication header exposure allows attackers to obtain sensitive credentials.
Linuxsecurity
2026-05-12
CVE-2026-43514 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-12
CVE-2026-43513 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-12
CVE-2026-43512 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-12
CVE-2026-43515 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-06-10
Ubuntu releases USN-8417-1
Ubuntu addresses multiple Tomcat vulnerabilities affecting several LTS versions.
Ubuntu

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

Ubuntu Tomcat DDoS Denial of Service