CLSA-2026-1793859817: TuxCare security update for 4 packages (3 CVEs)

Q: Which components should be checked when triaging this update?

Check deployments using the TuxCare builds of tomcat-embed-core, tomcat, tomcat-catalina, or tomcat-coyote. The advisory states that four packages were rebuilt to address three CVEs.

Q: What package version contains the fixes?

The fixes are available in version 9.0.13-tuxcare.5.

Q: Does the advisory identify temporary mitigations or exploitation prerequisites?

No. The provided advisory data does not describe affected configurations, attacker prerequisites, indicators of compromise, or mitigations for systems that cannot yet update.

Published Nov 5, 2026

Updated

TuxCare rebuilt 4 packages to address 3 CVEs. Fixed in 9.0.13-tuxcare.5.

Affected Software

4 affected componentsFixes available

tuxcare/org.apache.tomcat.embed:tomcat-embed-core>=9.0.13<9.0.13-tuxcare.5

9.0.13-tuxcare.5

tuxcare/org.apache.tomcat:tomcat>=9.0.13<9.0.13-tuxcare.5

9.0.13-tuxcare.5

tuxcare/org.apache.tomcat:tomcat-catalina>=9.0.13<9.0.13-tuxcare.5

9.0.13-tuxcare.5

tuxcare/org.apache.tomcat:tomcat-coyote>=9.0.13<9.0.13-tuxcare.5

9.0.13-tuxcare.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tuxcare/org.apache.tomcat.embed:tomcat-embed-core to a version that resolves this vulnerability.
Fixed in 9.0.13-tuxcare.5
Upgrade
Upgrade tuxcare/org.apache.tomcat:tomcat to a version that resolves this vulnerability.
Fixed in 9.0.13-tuxcare.5
Upgrade
Upgrade tuxcare/org.apache.tomcat:tomcat-catalina to a version that resolves this vulnerability.
Fixed in 9.0.13-tuxcare.5
Upgrade
Upgrade tuxcare/org.apache.tomcat:tomcat-coyote to a version that resolves this vulnerability.
Fixed in 9.0.13-tuxcare.5
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.13-tuxcare.5

Event History

Nov 5, 2026

Advisory Published

via OSV·07:23 AM

Data Sourced

via OSV·07:23 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which components should be checked when triaging this update?

Check deployments using the TuxCare builds of tomcat-embed-core, tomcat, tomcat-catalina, or tomcat-coyote. The advisory states that four packages were rebuilt to address three CVEs.

What package version contains the fixes?

The fixes are available in version 9.0.13-tuxcare.5.

Does the advisory identify temporary mitigations or exploitation prerequisites?

No. The provided advisory data does not describe affected configurations, attacker prerequisites, indicators of compromise, or mitigations for systems that cannot yet update.

CLSA-2026-1793859817: TuxCare security update for 4 packages (3 CVEs)

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which components should be checked when triaging this update?

What package version contains the fixes?

Does the advisory identify temporary mitigations or exploitation prerequisites?

Company

Resources

Contact

Frequently Asked Questions

Which components should be checked when triaging this update?

What package version contains the fixes?

Does the advisory identify temporary mitigations or exploitation prerequisites?