Skip to content
Critical Tomcat Vulnerabilities Affecting Multiple Ubuntu Releases

Critical Tomcat Vulnerabilities Affecting Multiple Ubuntu Releases

First seen 10 Jun 2026, 10:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •June 11, 2026 at 09:28 UTC
  • •Multiple critical vulnerabilities in Tomcat affect various Ubuntu versions.
  • •CVE-2026-41284 can lead to denial of service through unbounded WebDAV requests.
  • •Immediate updates are required to mitigate risks associated with these vulnerabilities.

On June 10, 2026, Ubuntu released USN-8417-1, addressing multiple vulnerabilities in Tomcat, including denial of service and authentication bypass issues. The vulnerabilities affect various Ubuntu versions, including 26.04 LTS and earlier releases. Key vulnerabilities include CVE-2026-41284, which allows excessive memory consumption through WebDAV requests, and CVE-2026-41293, which involves improper validation of HTTP/2 headers leading to potential crashes or arbitrary code execution. Other vulnerabilities include CVE-2026-42498, exposing sensitive credentials during WebSocket upgrades, and CVE-2026-43512, allowing unauthorized authentication. Administrators are advised to update their systems to mitigate these risks. The vulnerabilities were disclosed on May 12, 2026, and are considered critical due to their potential impact on system security.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 138d ago How this analysis works

Timeline

2026-05-12
CVE-2026-41284 published
Unbounded read in WebDAV LOCK and PROPFIND handling allows excessive memory consumption.
Linuxsecurity
2026-05-12
CVE-2026-41293 published
Improper validation of HTTP/2 request headers can lead to crashes or arbitrary code execution.
Linuxsecurity
2026-05-12
CVE-2026-42498 published
WebSocket authentication header exposure allows attackers to obtain sensitive credentials.
Linuxsecurity
2026-05-12
CVE-2026-43514 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-12
CVE-2026-43513 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-12
CVE-2026-43512 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-12
CVE-2026-43515 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-06-10
Ubuntu releases USN-8417-1
Ubuntu addresses multiple Tomcat vulnerabilities affecting several LTS versions.
Ubuntu

More articles in this cluster (16)

Following this threat?

Track Ubuntu and CVE-2026-41284 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 3