Debian Releases Security Advisories for Tomcat9, Tomcat10, and Tomcat11 Vulnerabilities

Linuxsecurity

Debian Releases Security Advisories for Tomcat9, Tomcat10, and Tomcat11 Vulnerabilities

First seen 8 Jun 2026, 21:23 UTC • •70.5

Article Content

1 / 4

Browse articles

ThreatCluster •June 9, 2026 at 21:00 UTC

•Debian released critical advisories for Tomcat9, Tomcat10, and Tomcat11 vulnerabilities.
•Tomcat9 and Tomcat10 vulnerabilities involve authentication bypass and denial-of-service risks.
•Users are advised to upgrade to the latest versions to mitigate security risks.

Debian has issued critical security advisories for Tomcat9, Tomcat10, and Tomcat11 addressing various vulnerabilities. Tomcat9 (DLA-4619) fixed an authentication bypass and denial-of-service issue in version 9.0.118-0+deb11u1. Tomcat10 (DSA-6328) addressed a similar critical denial-of-service vulnerability in versions 10.1.55-1~deb12u1 for oldstable and 10.1.55-1~deb13u1 for stable. Tomcat11 (DSA-6329) resolved a moderate DDoS vulnerability in version 11.0.22-1~deb13u1. All advisories recommend upgrading affected packages and consulting the respective documentation for further details. The vulnerabilities may introduce new options or limits that could impact existing web applications. Users are urged to apply updates promptly to mitigate potential risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 104d ago How this analysis works

Timeline

2026-06-07

Debian Tomcat9 advisory released

DLA-4619 addresses critical auth bypass and DoS vulnerabilities in Tomcat9, urging upgrades to version 9.0.118-0+deb11u1.

2026-06-08

Debian Tomcat10 advisory released

DSA-6328 fixes a critical denial-of-service vulnerability in Tomcat10, recommending upgrades to versions 10.1.55-1~deb12u1 and 10.1.55-1~deb13u1.

2026-06-08

Debian Tomcat11 advisory released

DSA-6329 addresses a moderate DDoS vulnerability in Tomcat11, advising upgrades to version 11.0.22-1~deb13u1.

More articles in this cluster (3)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

DDoS
Denial of Service

Organization (1)

Debian

Weakness (2)

CWE-200 - Exposure of Sensitive Information
CWE-287 - Improper Authentication

Affected Platform (1)

Linux

Relationships

DDoS targets Linux
Denial of Service targets Linux
DDoS related to Debian
DDoS related to CWE-200 - Exposure of Sensitive Information
DDoS related to CWE-287 - Improper Authentication

Following this threat?

Track Debian in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…