This bug was fixed in the package tomcat11 - 11.0.27~us1-0ubuntu1
---------------
tomcat11 (11.0.27~us1-0ubuntu1) tenacious; urgency=medium
* New upstream release (LP: #2171577):
- Release notes: https://tomcat.apache.org/tomcat-11.0-doc/changelog.html
- CVEs (11.0.27):
+ CVE-2026-103119: Important: AJP response mix-up
+ CVE-2026-101356: Important: HTTP/2 request/response mix-up after error
during async processing
+ CVE-2026-101296: Important: JNDIRealm bind credential validation fails
open for non-GSSAPI SASL mechanisms
+ CVE-2026-93446: Low: Possible TLS 1.3 connection failures
+ CVE-2026-88041: Low: HTTP/2 trailer header cross-contamination
+ CVE-2026-74049: Low: Jasper JSTL <c:redirect> plug-in implementation
omits page abort (SKIP_PAGE)
+ CVE-2026-74048: Low: OpenSSL-FFM FIPS failure does not prevent start-up
- CVEs (11.0.26):
+ CVE-2026-87022: Low: WebSocket message smuggling with
per-message-deflate
+ CVE-2026-86350: Important: Regression in fix for CVE-2026-41293 can
trigger request header mix-up
+ CVE-2026-86248: Moderate: Fix for CVE-2026-34500 was incomplete.
OCSP checks sometimes soft-fail with FFM even when soft-fail
is disabled
+ CVE-2026-79677: Moderate: WebSocket DoS due to lost asynchronous
write timeout
+ CVE-2026-78437: Low: HTTP/2 DoS via malformed request
+ CVE-2026-78383: Important: AJP DoS via missing request body
+ CVE-2026-77791: Important: DoS via busy wait during WebSocket close
+ CVE-2026-77762: Low: Stale HPACK emitter injects trailers into
recycled pooled Request
+ CVE-2026-77756: Low: Transfer-Encoding honored for HTTP/1.0 requests
+ CVE-2026-76183: Important: Bypass of security constraints for WebSocket
endpoints
+ CVE-2026-75973: Low: Cross-context authentication mix-up with Jakarta
Authentication configured
+ CVE-2026-73581: Moderate: OpenSSL and OpenSSL-FFM TLS implementations
ignore CRLs when certificate uses a keystore
+ CVE-2026-73180: Low: Authenticated WebSocket session survives
end of HTTP session
- CVEs (11.0.25):
+ CVE-2026-68763: Important: DoS via allocation leak in HTTP/2 backlog
tracking when a stream is reset
+ CVE-2026-68569: Important: Principal lookup could fail open
in some cases
+ CVE-2026-68525: Low: Redirect after FORM authentication may bypass
method specific constraints
+ CVE-2026-66422: Low: Servlet role references can bypass declarative
role constraints
+ CVE-2026-66299: Low: DoS in WebSocket chat example
+ CVE-2026-65927: Important: RewriteValve [N] restarts at the second rule
and may bypass access control
+ CVE-2026-65905: Low: Limited replay attack possible with DIGEST
authentication
+ CVE-2026-65637: Moderate: HTTP/2 no-authority bypass of strict
SNI validation
+ CVE-2026-65183: Low: TOCTOU when setting specific permissions for
Unix Domain Sockets
+ CVE-2026-65182: Important: Security constraint bypass
* d/p/0026-easymock4-compatibility.patch: Refresh patch.
[ Andreas Hasenack ]
* Fix logging for unprivileged rsyslogd (LP: #1964881):
- d/logrotate.template: use syslog:adm for log rotation so that
rsyslog can write to the file
- d/rsyslog/tomcat11.conf: drop "fileOwner" as it cannot be set by an
unprivileged rsyslogd
- d/tomcat11.postinst: adjust ownership of catalina.out so that
rsyslogd can write to it. Also change the rotated log files for
consistency.
-- Vladimir Petko <[email protected]> Wed, 21 Oct 2026
14:52:18 +1300
** Changed in: tomcat11 (Ubuntu Tenacious)
Status: New => Fix Released
** CVE added: https://cve.org/CVERecord?id=CVE-2026-101296
** CVE added: https://cve.org/CVERecord?id=CVE-2026-101356
** CVE added: https://cve.org/CVERecord?id=CVE-2026-103119
** CVE added: https://cve.org/CVERecord?id=CVE-2026-34500
** CVE added: https://cve.org/CVERecord?id=CVE-2026-41293
** CVE added: https://cve.org/CVERecord?id=CVE-2026-65182
** CVE added: https://cve.org/CVERecord?id=CVE-2026-65183
** CVE added: https://cve.org/CVERecord?id=CVE-2026-65637
** CVE added: https://cve.org/CVERecord?id=CVE-2026-65905
** CVE added: https://cve.org/CVERecord?id=CVE-2026-65927
** CVE added: https://cve.org/CVERecord?id=CVE-2026-66299
** CVE added: https://cve.org/CVERecord?id=CVE-2026-66422
** CVE added: https://cve.org/CVERecord?id=CVE-2026-68525
** CVE added: https://cve.org/CVERecord?id=CVE-2026-68569
** CVE added: https://cve.org/CVERecord?id=CVE-2026-68763
** CVE added: https://cve.org/CVERecord?id=CVE-2026-73180
** CVE added: https://cve.org/CVERecord?id=CVE-2026-73581
** CVE added: https://cve.org/CVERecord?id=CVE-2026-74048
** CVE added: https://cve.org/CVERecord?id=CVE-2026-74049
** CVE added: https://cve.org/CVERecord?id=CVE-2026-75973
** CVE added: https://cve.org/CVERecord?id=CVE-2026-76183
** CVE added: https://cve.org/CVERecord?id=CVE-2026-77756
** CVE added: https://cve.org/CVERecord?id=CVE-2026-77762
** CVE added: https://cve.org/CVERecord?id=CVE-2026-77791
** CVE added: https://cve.org/CVERecord?id=CVE-2026-78383
** CVE added: https://cve.org/CVERecord?id=CVE-2026-78437
** CVE added: https://cve.org/CVERecord?id=CVE-2026-79677
** CVE added: https://cve.org/CVERecord?id=CVE-2026-86248
** CVE added: https://cve.org/CVERecord?id=CVE-2026-86350
** CVE added: https://cve.org/CVERecord?id=CVE-2026-87022
** CVE added: https://cve.org/CVERecord?id=CVE-2026-88041
** CVE added: https://cve.org/CVERecord?id=CVE-2026-93446
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171577
Title:
please update tomcat11 to 11.0.27
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tomcat11/+bug/2171577/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
