SB2026031245 - SUSE update for tomcat11

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Improper authorization (CVE-ID: CVE-2025-66614)

The vulnerability allows a remote attacker to bypass client certificate verification.

The vulnerability exists due to Tomcat does not validate that the host name provided via the SNI extension is the same as the host name provided in the HTTP host header field. If there is more than one virtual host configured and the TLS configuration for one of those hosts does not require client certificate authentication, it is possible for a client to bypass the client certificate authentication for the target host by sending different host names in the SNI extension and the HTTP host header field.

2) Protection mechanism failure (CVE-ID: CVE-2026-24733)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures when handling HTTP/0.9 requests. If the server is configured to allow HEAD requests to a URI but deny GET requests, an attacker can bypass that constraint on GET requests by sending a (specification invalid) HEAD request.

3) Improper authorization (CVE-ID: CVE-2026-24734)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to incomplete OCSP verification checks. When using an OCSP responder, Tomcat's FFM integration with OpenSSL does not complete verification or freshness checks on the OCSP response. A remote attacker can bypass certificate revocation and gain unauthorized access to the application. 

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2026/suse-su-20260877-1/