SB2026110114 - SUSE update for libapr1, libtcnative-1-0, tomcat
Published: November 1, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 25 vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2026-77791)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a busy wait in WebSocket close message handling when sending a WebSocket close message. A remote attacker can trigger the busy wait to cause a denial of service.
2) Incomplete cleanup (CVE-ID: CVE-2026-93446)
CWE-ID: CWE-459 - Incomplete cleanup
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause intermittent TLS 1.3 connection failures, disrupting access to the service.
The vulnerability exists due to incomplete cleanup in Apache Tomcat TLS connection handling when processing TLS 1.3 connections. A remote attacker can trigger affected connection handling to cause intermittent connection failures.
3) Incomplete cleanup (CVE-ID: CVE-2026-88041)
CWE-ID: CWE-459 - Incomplete cleanup
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause HTTP/2 trailer information to cross request boundaries, potentially disclosing information or contaminating another request.
The vulnerability exists due to incomplete cleanup in Apache Tomcat HTTP/2 trailer header processing when handling successive requests. A remote attacker can trigger affected request processing to cause trailer information from a previous request to leak into a subsequent request.
4) Input validation error (CVE-ID: CVE-2026-87022)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to smuggle WebSocket messages.
The vulnerability exists due to improper handling of a length parameter in WebSocket per-message-deflate processing when processing WebSocket messages with per-message-deflate enabled. A remote attacker can send a crafted WebSocket message to smuggle WebSocket messages.
Only WebSocket connections using per-message-deflate are affected.
5) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-86350)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a request header mix-up.
The vulnerability exists due to inconsistent interpretation of HTTP/2 requests in HTTP/2 request processing when handling HTTP/2 requests. A remote attacker can send a crafted HTTP/2 request to cause a request header mix-up.
The issue is a regression in the fix for CVE-2026-41293.
6) Improper Certificate Validation (CVE-ID: CVE-2026-86248)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass client certificate authentication.
The vulnerability exists due to improper certificate validation in CLIENT_CERT authentication when validating OCSP status with OCSP soft fail disabled. A remote attacker can present a certificate in affected scenarios to bypass client certificate authentication.
The issue occurs in some scenarios when OCSP soft fail is disabled.
7) Race condition (CVE-ID: CVE-2026-86247)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass client certificate verification requirements.
The vulnerability exists due to a race condition in Apache Tomcat Native when verifying client certificates. A remote attacker can exploit the race condition to bypass client certificate verification requirements.
Only some configurations are affected.
8) Insecure Default Initialization of Resource (CVE-ID: CVE-2026-86246)
CWE-ID: CWE-1188 - Insecure Default Initialization of Resource
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to weaken TLS connection security.
The vulnerability exists due to insecure default configuration in Apache Tomcat Native's OpenSSL option configuration when establishing TLS connections. A remote attacker can exploit the insecurely enabled OpenSSL options to weaken TLS connection security.
9) Out-of-bounds read (CVE-ID: CVE-2026-86243)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a buffer over-read in Apache Tomcat Native during TLS handshaking when processing a TLS handshake. A remote attacker can initiate a TLS handshake to cause a denial of service.
10) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-80353)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain unauthorized access to a Unix domain socket.
The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in the Apache Tomcat APR/Native connector when creating Unix domain sockets and setting their permissions. A local user can exploit the timing window to access a socket without the intended authorization.
11) Race condition (CVE-ID: CVE-2026-79677)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a concurrency bug in asynchronous WebSocket write handling when performing asynchronous WebSocket writes. A remote attacker can trigger lost write timeouts to cause a denial of service.
12) Resource exhaustion (CVE-ID: CVE-2026-78437)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause another user's request to fail.
The vulnerability exists due to improper handling of malformed HTTP/2 requests in HTTP/2 request processing when handling a malformed HTTP/2 request. A remote attacker can send a malformed HTTP/2 request to cause another user's request to fail.
Successful exploitation depends on timing.
13) Resource exhaustion (CVE-ID: CVE-2026-78383)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of requests without a body in AJP request processing when processing an AJP request without a request body. A remote attacker can send an AJP request without a request body to cause a denial of service.
An affected request can pin an AJP processing thread.
14) Out-of-bounds read (CVE-ID: CVE-2017-12613)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to an out-of-bounds array dereference in the apr_time_exp_get() function. A remote attacker can access prior out-of-bounds memory, reveal the contents of a different static heap value and read arbitrary files or cause the application to crash.
15) Race condition (CVE-ID: CVE-2026-77762)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject trailer fields into another HTTP/2 request.
The vulnerability exists due to a race condition in the HPACK emitter when processing HTTP/2 requests with recycled pooled requests. A remote attacker can trigger the race condition to inject trailer fields into another HTTP/2 request.
16) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-77756)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause another user's request to fail.
The vulnerability exists due to improper handling of the Transfer-Encoding header in HTTP/1.0 request processing when processing an HTTP/1.0 request behind a reverse proxy. A remote attacker can send an HTTP/1.0 request with a Transfer-Encoding header to cause another user's request to fail.
The issue requires Tomcat to be located behind a reverse proxy.
17) Improper access control (CVE-ID: CVE-2026-76183)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security constraints for WebSocket endpoints.
The vulnerability exists due to incorrect parsing of request paths as endpoint templates in WebSocket endpoint processing when processing a request for a WebSocket endpoint. A remote attacker can send a request with a crafted path to bypass security constraints for WebSocket endpoints.
18) Improper Authentication (CVE-ID: CVE-2026-75973)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause authentication to use another web application's realm.
The vulnerability exists due to improper isolation of authentication realms in Jakarta Authentication when multiple web applications use SimpleAuthConfigProvider as the default provider. A remote user can authenticate to a web application to cause authentication to use another web application's realm.
Authentication uses the realm of the first web application to authenticate a request.
19) Execution After Redirect (EAR) (CVE-ID: CVE-2026-74049)
CWE-ID: CWE-698 - Execution After Redirect (EAR)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause page processing to continue after a redirect, potentially executing application logic that was intended to be skipped.
The vulnerability exists due to failure to terminate page processing in the Apache Tomcat Jasper JSTL <c:redirect> plug-in replacement when issuing a redirect. A remote attacker can request a page that executes the affected redirect tag to cause the remaining page logic to run despite the redirect.
20) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-74048)
CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to benefit from TLS operation outside the configured FIPS restrictions after FIPS activation fails.
The vulnerability exists due to failing open in Apache Tomcat OpenSSLLifecycleListener when FIPS activation fails despite being configured for FIPS mode. A local user can take advantage of continued startup using JSSE in non-FIPS mode to bypass the intended FIPS operating requirement.
21) Improper Certificate Validation (CVE-ID: CVE-2026-73581)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate revocation checks.
The vulnerability exists due to improper certificate validation in the OpenSSL and OpenSSL-FFM TLS implementations when validating a certificate that uses a keystore. A remote attacker can present a certificate subject to certificate revocation checks to bypass certificate revocation checks.
The issue affects both the OpenSSL and OpenSSL-FFM TLS implementations when the certificate uses a keystore.
22) Input validation error (CVE-ID: CVE-2026-41293)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger unexpected application behavior.
The vulnerability exists due to improper input validation in HTTP/2 request header handling when exposing header values through the Servlet API. A remote attacker can send crafted HTTP/2 request headers to trigger unexpected application behavior.
This may affect applications that assume header values exposed through the Servlet API are specification compliant.
23) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-101356)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause requests or responses to be mixed up between users, potentially disclosing information or causing requests to be processed in the wrong user context.
The vulnerability exists due to incorrect object recycling and reuse in Apache Tomcat HTTP/2 asynchronous servlet processing when handling errors during asynchronous processing. A remote attacker can trigger affected request processing to cause request or response data to be associated with another user.
24) Missing Critical Step in Authentication (CVE-ID: CVE-2026-101296)
CWE-ID: CWE-304 - Missing Critical Step in Authentication
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass password authentication.
The vulnerability exists due to a missing critical authentication step in Apache Tomcat JNDIRealm when authenticating with a non-GSSAPI SASL mechanism. A remote attacker can attempt authentication without providing the correct password to gain access as an authenticated user.
25) Incorrect default permissions (CVE-ID: CVE-2023-49582)
CWE-ID: CWE-276 - Incorrect Default Permissions
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to lax permissions set by the Apache Portable Runtime library on Unix platforms. A local user can read the named shared memory segments.
Remediation
Install update from vendor's website.