SB2026111301 - Debian update for tomcat10
Published: November 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 19 vulnerabilities.
1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-65183)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to access the Unix domain socket.
The vulnerability exists due to a race condition in Unix domain socket creation when setting specific permissions. A local user can win the race during socket creation to access the Unix domain socket.
2) Insufficient Session Expiration (CVE-ID: CVE-2026-73180)
CWE-ID: CWE-613 - Insufficient Session Expiration
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to maintain an authenticated websocket session after the associated http session has ended.
The vulnerability exists due to improper session management in the websocket session handling when the session id of an authenticated http session is changed after a websocket connection has been established. A remote user can continue using the websocket connection to maintain an authenticated websocket session after the associated http session has ended.
The issue occurs only if the session id for the authenticated http session is changed after the websocket connection has already been established.
3) Memory leak (CVE-ID: CVE-2026-68763)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an allocation leak in HTTP/2 backlog tracking when processing a reset stream. A remote attacker can reset a stream to cause a denial of service.
4) Improper Authentication (CVE-ID: CVE-2026-68569)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass authentication.
The vulnerability exists due to improper authentication in DataSourceRealm and JDBCRealm when processing principal lookups for certain authentication methods. A remote user can authenticate with CLIENT-CERT or SPNEGO even if the user does not exist in the configured realm to bypass authentication.
The issue affects some authentication methods, including CLIENT-CERT and SPNEGO.
5) Improper access control (CVE-ID: CVE-2026-68525)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass method-specific access controls.
The vulnerability exists due to improper access control in the FORM authentication process when handling a redirect after authentication. A remote user can complete FORM authentication and use the redirect flow to bypass method-specific access controls.
The issue affects constraints that restrict access to a resource for POST requests but not GET requests.
6) Improper access control (CVE-ID: CVE-2026-66422)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass declarative role constraints.
The vulnerability exists due to improper access control in Realm role handling when processing security-role-ref definitions. A remote user can use servlet role references as role aliases to bypass declarative role constraints.
7) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-66299)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in the WebSocket chat example when buffering undelivered messages for a maliciously slow client connection. A remote attacker can maintain a slow client connection to cause a denial of service.
Only deployments exposing the example web application are vulnerable.
8) Off-by-one (CVE-ID: CVE-2026-65927)
CWE-ID: CWE-193 - Off-by-one Error
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass access control.
The vulnerability exists due to an off-by-one error in RewriteValve when processing rewrite rules that use the [N] flag. A remote attacker can trigger rewrite processing to restart at the second rule instead of the first rule to bypass access control.
9) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-65905)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to replay a DIGEST-authenticated request once.
The vulnerability exists due to improper authentication in DIGEST authentication replay protection when processing a DIGEST-authenticated request with a nonceCount on the upper boundary of the replay window before windowSize requests had been made. A remote user can send and replay a crafted DIGEST-authenticated request to replay a DIGEST-authenticated request once.
The issue only occurs while the associated nonceCount remains within the replay window.
10) Improper access control (CVE-ID: CVE-2026-65637)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass strict SNI validation.
The vulnerability exists due to improper access control in the HTTP/2 request handling when processing requests without an authority field. A remote attacker can send a specially crafted HTTP/2 request to bypass strict SNI validation.
The issue is related to an incomplete fix for a previous vulnerability.
11) Cross-site scripting (CVE-ID: CVE-2026-50229)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute cross-site scripting.
The vulnerability exists due to cross-site scripting in the number guess example when using wild card property mapping that exposes internal properties to clients. A remote attacker can supply crafted input that is reflected through exposed properties to execute cross-site scripting.
The issue is limited to the number guess example application.
12) Improper access control (CVE-ID: CVE-2026-65182)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security constraints.
The vulnerability exists due to improper access control in security constraint processing when handling requests for paths with overlapping constraints. A remote attacker can send a crafted request to bypass security constraints.
The issue occurs if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.
13) Insufficient Technical Documentation (CVE-ID: CVE-2026-59084)
CWE-ID: CWE-1059 - Insufficient Technical Documentation
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass encryption protections.
The vulnerability exists due to improper documentation in EncryptInterceptor configuration when deploying the feature. A remote user can leverage an insecure configuration to bypass encryption protections.
14) Incorrect Behavior Order: Validate Before Canonicalize (CVE-ID: CVE-2026-59083)
CWE-ID: CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security controls.
The vulnerability exists due to incorrect URL decoding in RewriteValve when processing rewritten URIs. A remote attacker can send a specially crafted request to bypass security controls.
Only some configurations are vulnerable.
15) Improper access control (CVE-ID: CVE-2026-55956)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass security constraints.
The vulnerability exists due to improper access control in the default servlet when processing requests subject to configured security constraints with method or method omission settings. A remote attacker can send a crafted request using an ignored method to bypass security constraints.
16) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-55955)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to replay protected communications.
The vulnerability exists due to missing replay protection in EncryptInterceptor when processing encrypted messages. A remote attacker can capture and resend previously valid messages to replay protected communications.
17) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-55276)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to obtain incomplete security configuration information.
The vulnerability exists due to logic errors in effective web.xml generation in the logged effective web.xml output when generating configuration logs. A local user can review the logged output to obtain incomplete security configuration information.
Special roles and empty authorization constraints are omitted from the logged effective web.xml.
18) Improper Certificate Validation (CVE-ID: CVE-2026-53434)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to authenticate with an invalid certificate.
The vulnerability exists due to improper certificate revocation validation in the FFM Connector when handling connections with invalid CRL configuration. A remote attacker can present an invalid certificate to authenticate with an invalid certificate.
Only configurations using the FFM Connector with invalid CRLs are affected.
19) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53404)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass rewrite conditions.
The vulnerability exists due to logic errors in RewriteValve when processing requests against OR-chained rewrite conditions. A remote attacker can send a request that matches the first OR condition to bypass rewrite conditions.
Exploitation requires a rule set that uses an OR chain followed by non-OR conditions.
Remediation
Install update from vendor's website.