SB2026102710 - Anolis OS update for tomcat
Published: October 27, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Missing Critical Step in Authentication (CVE-ID: CVE-2026-101296)
CWE-ID: CWE-304 - Missing Critical Step in Authentication
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass password authentication.
The vulnerability exists due to a missing critical authentication step in Apache Tomcat JNDIRealm when authenticating with a non-GSSAPI SASL mechanism. A remote attacker can attempt authentication without providing the correct password to gain access as an authenticated user.
2) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-101356)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause requests or responses to be mixed up between users, potentially disclosing information or causing requests to be processed in the wrong user context.
The vulnerability exists due to incorrect object recycling and reuse in Apache Tomcat HTTP/2 asynchronous servlet processing when handling errors during asynchronous processing. A remote attacker can trigger affected request processing to cause request or response data to be associated with another user.
3) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-74048)
CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to benefit from TLS operation outside the configured FIPS restrictions after FIPS activation fails.
The vulnerability exists due to failing open in Apache Tomcat OpenSSLLifecycleListener when FIPS activation fails despite being configured for FIPS mode. A local user can take advantage of continued startup using JSSE in non-FIPS mode to bypass the intended FIPS operating requirement.
4) Execution After Redirect (EAR) (CVE-ID: CVE-2026-74049)
CWE-ID: CWE-698 - Execution After Redirect (EAR)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause page processing to continue after a redirect, potentially executing application logic that was intended to be skipped.
The vulnerability exists due to failure to terminate page processing in the Apache Tomcat Jasper JSTL <c:redirect> plug-in replacement when issuing a redirect. A remote attacker can request a page that executes the affected redirect tag to cause the remaining page logic to run despite the redirect.
5) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-80353)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain unauthorized access to a Unix domain socket.
The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in the Apache Tomcat APR/Native connector when creating Unix domain sockets and setting their permissions. A local user can exploit the timing window to access a socket without the intended authorization.
6) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-65183)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to access the Unix domain socket.
The vulnerability exists due to a race condition in Unix domain socket creation when setting specific permissions. A local user can win the race during socket creation to access the Unix domain socket.
7) Incomplete cleanup (CVE-ID: CVE-2026-88041)
CWE-ID: CWE-459 - Incomplete cleanup
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause HTTP/2 trailer information to cross request boundaries, potentially disclosing information or contaminating another request.
The vulnerability exists due to incomplete cleanup in Apache Tomcat HTTP/2 trailer header processing when handling successive requests. A remote attacker can trigger affected request processing to cause trailer information from a previous request to leak into a subsequent request.
8) Incomplete cleanup (CVE-ID: CVE-2026-93446)
CWE-ID: CWE-459 - Incomplete cleanup
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause intermittent TLS 1.3 connection failures, disrupting access to the service.
The vulnerability exists due to incomplete cleanup in Apache Tomcat TLS connection handling when processing TLS 1.3 connections. A remote attacker can trigger affected connection handling to cause intermittent connection failures.
Remediation
Install update from vendor's website.