Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN859 _____________________________________________________________________ DATE : 27/08/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Apache Tomcat. ===================================================================== https://lists.apache.org/thread/bn0mtpf9p54to6lnm0r07lt9jlvp0goj https://lists.apache.org/thread/dch3wv5ol5t8o4cymh9kbkzrj732prhc https://lists.apache.org/thread/hk722clhsxqxwkjqjys0kmljmlnhhllp https://lists.apache.org/thread/rqfzjrdzh4c39tw8qpv6dm8xohtc7gjv https://lists.apache.org/thread/s9n55wcm58vk9orlkn7l0sb7j4xfnrgq https://lists.apache.org/thread/y7q483yscyw3hrmb8k1tt8dm5mjzq13o https://lists.apache.org/thread/qbq555o6722xw4t37l28y03h4x1cnyzx https://lists.apache.org/thread/dywhxs7v9c9ww1xvv7h4102vn50hx3sh https://lists.apache.org/thread/9jwxxmr6dqx1h514k6omvmj0fxvbmtcb https://lists.apache.org/thread/g0dvvbt0ksxhcork9r9nl41w2jl21wfh _____________________________________________________________________ [SECURITY] CVE-2026-65182 Apache Tomcat - Security constraint bypass CVE-2026-65182 Apache Tomcat - Security constraint bypass Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.24 Apache Tomcat 10.1.0-M1 to 10.1.57 Apache Tomcat 9.0.0.M1 to 9.0.120 Description: The security constraint processing enabled a security constraint bypass if a constraint for a longer path was specified before a more restrictive constraint for a shorter sub-path. Mitigation: Users of the affected versions should apply one of the following mitigations: - Remove the examples web application - Upgrade to Apache Tomcat 11.0.25 - Upgrade to Apache Tomcat 10.1.59 - Upgrade to Apache Tomcat 9.0.121 Note: This issue was fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions. Credit: This issue was identified by: - 4ra1n, pyn3rd and unam4 History: 2026-08-25 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-65637 Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.20 to 11.0.24 Apache Tomcat 10.1.53 to 10.1.57 Apache Tomcat 9.0.115 to 9.0.120 Description: The fix for CVE-2026-32990 was incomplete. Mitigation: Users of the affected versions should apply one of the following mitigations: - Remove the examples web application - Upgrade to Apache Tomcat 11.0.25 - Upgrade to Apache Tomcat 10.1.59 - Upgrade to Apache Tomcat 9.0.121 Note: This issue was fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions. Credit: This issue was identified by: - Parag Ambildhuke (https://github.com/paragxa) History: 2026-08-25 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-65927 Apache Tomcat - RewriteValve [N] restarts at the second rule and may bypass access control Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.24 Apache Tomcat 10.1.0-M1 to 10.1.57 Apache Tomcat 9.0.0.M1 to 9.0.120 Description: An off-by-one error impacting the [N] flag on the rewrite valves caused rewrite processing to restart at the second rule rather than the first rule. Mitigation: Users of the affected versions should apply one of the following mitigations: - Remove the examples web application - Upgrade to Apache Tomcat 11.0.25 - Upgrade to Apache Tomcat 10.1.59 - Upgrade to Apache Tomcat 9.0.121 Note: This issue was fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions. Credit: This issue was identified by: - 4ra1n, pyn3rd and unam4 History: 2026-08-25 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-68569 Apache Tomcat - Principal lookup can fail open in some cases Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.24 Apache Tomcat 10.1.0-M1 to 10.1.57 Apache Tomcat 9.0.0.M1 to 9.0.120 Description: For some authentication methods (e.g. CLIENT-CERT, SPNEGO), a user would be authenticated even if the user did not exist in the DataSourceRealm or JDBCRealm. Mitigation: Users of the affected versions should apply one of the following mitigations: - Remove the examples web application - Upgrade to Apache Tomcat 11.0.25 - Upgrade to Apache Tomcat 10.1.59 - Upgrade to Apache Tomcat 9.0.121 Note: This issue was fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions. History: 2026-08-25 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-68763 Apache Tomcat - DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.24 Apache Tomcat 10.1.0-M1 to 10.1.57 Apache Tomcat 9.0.39 to 9.0.120 Description: An allocation leak in the HTTP/2 backlog tracking when a stream was reset could be manipulated to trigger a denial of service. Mitigation: Users of the affected versions should apply one of the following mitigations: - Remove the examples web application - Upgrade to Apache Tomcat 11.0.25 - Upgrade to Apache Tomcat 10.1.59 - Upgrade to Apache Tomcat 9.0.121 Note: This issue was fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions. Credit: This issue was identified by: - Zhen Kong History: 2026-08-25 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-65183 Apache Tomcat - TOCTOU when setting specific permissions for Unix Domain Sockets Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.24 Apache Tomcat 10.1.0-M1 to 10.1.57 Apache Tomcat 9.0.42 to 9.0.120 Description: A race condition when creating a Unix Domain Socket allowed an unauthorised local user to access the Unix Domain Socket. Mitigation: Users of the affected versions should apply one of the following mitigations: - Remove the examples web application - Upgrade to Apache Tomcat 11.0.25 - Upgrade to Apache Tomcat 10.1.59 - Upgrade to Apache Tomcat 9.0.121 Note: This issue was fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions. History: 2026-08-25 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-65905 Apache Tomcat - Limited replay attack possible with DIGEST authentication Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.24 Apache Tomcat 10.1.0-M1 to 10.1.57 Apache Tomcat 9.0.0.M1 to 9.0.120 Description: If, before windowSize requests had been made, a client made a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request was replayable once only while the associated nonceCount remained within the replay window. Mitigation: Users of the affected versions should apply one of the following mitigations: - Remove the examples web application - Upgrade to Apache Tomcat 11.0.25 - Upgrade to Apache Tomcat 10.1.59 - Upgrade to Apache Tomcat 9.0.121 Note: This issue was fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions. Credit: This issue was identified by: - 4ra1n, pyn3rd and unam4 History: 2026-08-25 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-66422 Apache Tomcat - Servlet role references can bypass declarative role constraints Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.24 Apache Tomcat 10.1.0-M1 to 10.1.57 Apache Tomcat 9.0.25 to 9.0.120 Description: security-role-ref definitions were incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole() Mitigation: Users of the affected versions should apply one of the following mitigations: - Remove the examples web application - Upgrade to Apache Tomcat 11.0.25 - Upgrade to Apache Tomcat 10.1.59 - Upgrade to Apache Tomcat 9.0.121 Note: This issue was fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions. Credit: This issue was identified by: - 4ra1n, pyn3rd and unam4 History: 2026-08-25 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-68525 Apache Tomcat - Redirect after FORM authentication may bypass method specific constraints Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.24 Apache Tomcat 10.1.0-M1 to 10.1.57 Apache Tomcat 9.0.0.M1 to 9.0.120 Description: The FORM authentication process allowed the bypassing of a security constraint that limited user access to a resource POST but not GET. Mitigation: Users of the affected versions should apply one of the following mitigations: - Remove the examples web application - Upgrade to Apache Tomcat 11.0.25 - Upgrade to Apache Tomcat 10.1.59 - Upgrade to Apache Tomcat 9.0.121 Note: This issue was fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions. Credit: This issue was identified by: - 4ra1n, pyn3rd and unam4 History: 2026-08-25 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-73180 Apache Tomcat - Authenticated WebSocket session survives end of HTTP session Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.24 Apache Tomcat 10.1.0-M1 to 10.1.57 Apache Tomcat 9.0.0.M1 to 9.0.120 Description: If the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended. Mitigation: Users of the affected versions should apply one of the following mitigations: - Remove the examples web application - Upgrade to Apache Tomcat 11.0.25 - Upgrade to Apache Tomcat 10.1.59 - Upgrade to Apache Tomcat 9.0.121 Note: This issue was fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions. Credit: This issue was identified by: - 0xCc.zhang History: 2026-08-25 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================