SB2026102007 - Anolis OS update for tomcat

Description

This security bulletin contains information about 29 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-41293)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger unexpected application behavior.

The vulnerability exists due to improper input validation in HTTP/2 request header handling when exposing header values through the Servlet API. A remote attacker can send crafted HTTP/2 request headers to trigger unexpected application behavior.

This may affect applications that assume header values exposed through the Servlet API are specification compliant.

2) Insufficient Technical Documentation (CVE-ID: CVE-2026-59084)

CWE-ID: CWE-1059 - Insufficient Technical Documentation

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass encryption protections.

The vulnerability exists due to improper documentation in EncryptInterceptor configuration when deploying the feature. A remote user can leverage an insecure configuration to bypass encryption protections.

3) Incorrect Behavior Order: Validate Before Canonicalize (CVE-ID: CVE-2026-59083)

CWE-ID: CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security controls.

The vulnerability exists due to incorrect URL decoding in RewriteValve when processing rewritten URIs. A remote attacker can send a specially crafted request to bypass security controls.

Only some configurations are vulnerable.

4) Improper authentication (CVE-ID: CVE-2026-55957)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to improper authentication in JNDIRealm when authenticating binds using GSSAPI. A remote attacker can authenticate without providing the correct password to bypass authentication.

5) Improper access control (CVE-ID: CVE-2026-55956)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security constraints.

The vulnerability exists due to improper access control in the default servlet when processing requests subject to configured security constraints with method or method omission settings. A remote attacker can send a crafted request using an ignored method to bypass security constraints.

6) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-55955)

CWE-ID: CWE-294 - Authentication Bypass by Capture-replay

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to replay protected communications.

The vulnerability exists due to missing replay protection in EncryptInterceptor when processing encrypted messages. A remote attacker can capture and resend previously valid messages to replay protected communications.

7) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-55276)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain incomplete security configuration information.

The vulnerability exists due to logic errors in effective web.xml generation in the logged effective web.xml output when generating configuration logs. A local user can review the logged output to obtain incomplete security configuration information.

Special roles and empty authorization constraints are omitted from the logged effective web.xml.

8) Improper Certificate Validation (CVE-ID: CVE-2026-53434)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to authenticate with an invalid certificate.

The vulnerability exists due to improper certificate revocation validation in the FFM Connector when handling connections with invalid CRL configuration. A remote attacker can present an invalid certificate to authenticate with an invalid certificate.

Only configurations using the FFM Connector with invalid CRLs are affected.

9) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53404)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass rewrite conditions.

The vulnerability exists due to logic errors in RewriteValve when processing requests against OR-chained rewrite conditions. A remote attacker can send a request that matches the first OR condition to bypass rewrite conditions.

Exploitation requires a rule set that uses an OR chain followed by non-OR conditions.

10) Cross-site scripting (CVE-ID: CVE-2026-50229)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute cross-site scripting.

The vulnerability exists due to cross-site scripting in the number guess example when using wild card property mapping that exposes internal properties to clients. A remote attacker can supply crafted input that is reflected through exposed properties to execute cross-site scripting.

The issue is limited to the number guess example application.

11) Improper access control (CVE-ID: CVE-2026-43515)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security constraints.

The vulnerability exists due to improper access control in HTTP method constraint processing when evaluating multiple security constraints for the same extension pattern. A remote attacker can send a request using an improperly constrained HTTP method to bypass security constraints.

12) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-43514)

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose the AJP secret.

The vulnerability exists due to observable timing discrepancy in AJP secret comparison when validating the AJP secret. A remote attacker can perform a timing attack to disclose the AJP secret.

Exploitation is limited to an attacker on the local network.

13) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-43513)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to weaken brute-force protection against a user's password.

The vulnerability exists due to improper input handling in LockOutRealm when processing case-insensitive user names. A remote attacker can vary the case of a user name during authentication attempts to weaken brute-force protection against a user's password.

This affects Realms where user names are treated as case insensitive.

14) Improper Authentication (CVE-ID: CVE-2026-43512)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to authenticate as an unknown user.

The vulnerability exists due to improper authentication in the DIGEST authenticator when processing authentication for users not known to the configured Realm. A remote attacker can submit the password "null" for an unknown user to authenticate as an unknown user.

This occurs only when DIGEST authentication is configured.

15) Information disclosure (CVE-ID: CVE-2026-42498)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose authentication headers to a redirect target host.

The vulnerability exists due to exposure of sensitive information in Tomcat's WebSocket client when following a redirected WebSocket request after authentication. A remote user can trigger a redirect after authentication to disclose authentication headers to a redirect target host.

The issue occurs only if a WebSocket request is redirected after authentication.

16) Improper Authentication (CVE-ID: CVE-2024-52316)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests. If Tomcat was configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not have failed, allowing the user to bypass the authentication process.

17) Resource exhaustion (CVE-ID: CVE-2026-41284)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in WebDAV LOCK and PROPFIND handling when processing request bodies. A remote attacker can send a large request body to cause a denial of service.

The affected requests are available to unauthenticated users.

18) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-34487)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log output in the cloud membership for clustering component when writing log messages. A remote attacker can trigger log entries that expose the Kubernetes bearer token to disclose sensitive information.

19) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-34483)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to inject arbitrary JSON into the JSON access log.

The vulnerability exists due to incomplete escaping in the JSON access log when handling requests with non-default Connector attributes relaxedPathChars and/or relaxedQueryChars. A remote attacker can send a specially crafted request to inject arbitrary JSON into the JSON access log.

Only configurations using non-default values for relaxedPathChars and/or relaxedQueryChars are affected.

20) Improper Certificate Validation (CVE-ID: CVE-2026-29145)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass certificate revocation checks during authentication.

The vulnerability exists due to improper certificate validation in CLIENT_CERT authentication when processing OCSP checks in some scenarios with soft fail disabled. A remote user can present a certificate in affected scenarios to bypass certificate revocation checks during authentication.

Only some scenarios are affected when soft fail is disabled.

21) Open redirect (CVE-ID: CVE-2026-25854)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to redirect users to an arbitrary URI.

The vulnerability exists due to improper input validation in LoadBalancerDrainingValve when handling a specially crafted URL while a Tomcat node is in the disabled (draining) state. A remote attacker can send a specially crafted URL to redirect users to an arbitrary URI.

Only clustered deployments using LoadBalancerDrainingValve in the disabled (draining) state are affected.

22) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-24880)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform request smuggling.

The vulnerability exists due to improper input validation in HTTP/1.1 chunk extension handling when parsing chunked requests. A remote attacker can send a specially crafted request with an invalid chunk extension to perform request smuggling.

Exploitation requires a reverse proxy in front of Tomcat that allows CRLF sequences in an otherwise valid chunk extension.

23) Protection mechanism failure (CVE-ID: CVE-2026-24733)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures when handling HTTP/0.9 requests. If the server is configured to allow HEAD requests to a URI but deny GET requests, an attacker can bypass that constraint on GET requests by sending a (specification invalid) HEAD request.

24) Improper authorization (CVE-ID: CVE-2025-66614)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass client certificate verification.

The vulnerability exists due to Tomcat does not validate that the host name provided via the SNI extension is the same as the host name provided in the HTTP host header field. If there is more than one virtual host configured and the TLS configuration for one of those hosts does not require client certificate authentication, it is possible for a client to bypass the client certificate authentication for the target host by sending different host names in the SNI extension and the HTTP host header field.

25) Resource exhaustion (CVE-ID: CVE-2025-61795)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling errors while processing multipart upload. Depending on JVM settings, application memory usage and application load, it is possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

26) Improper Output Neutralization for Logs (CVE-ID: CVE-2025-55754)

CWE-ID: CWE-117 - Improper Output Neutralization for Logs

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary OS commands.

The vulnerability exists due to improper input validation of ANSI escape sequences in log messages. A remote attacker can use a crafted URL to inject ANSI escape sequences to manipulate the console and the clip-boardand potentially execute arbitrary code.

The vulnerability affects Windows installations only.

27) Session Fixation (CVE-ID: CVE-2025-55668)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to session fixation. A remote attacker can trick the victim into opening a specially crafted request to gain unauthorized access to sensitive information on the system.

28) Improper handling of case sensitivity (CVE-ID: CVE-2025-46701)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to an error when handling URLs on a case insensitive filesystem with security constraints configured for the <code>pathInfo</code> component of a URL that mapped to the CGI servlet. A remote attacker can bypass imposed security constraints via a specially crafted URL.

29) Resource exhaustion (CVE-ID: CVE-2024-54677)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the examples web application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://anas.openanolis.cn/errata/detail/ANSA-2026:1519