MGASA-2026-0568: Updated tomcat package fixes security vulnerabilities

Q: When was this advisory published and last updated?

It was published on 2026-10-30 and was last modified on 2026-10-30.

Published Oct 30, 2026

Updated

OpenSSL-FFM FIPS failure does not prevent start-up. (CVE-2026-74048) Jasper JSTL plug-in implementation omits page abort (SKIPPAGE). (CVE-2026-74049) TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector. (CVE-2026-80353) HTTP/2 trailer header cross-contamination. (CVE-2026-88041) Possible TLS 1.3 connection failures. (CVE-2026-93446) JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms. (CVE-2026-101296) HTTP/2 request/response mix-up after error during async processing. (CVE-2026-101356)

Affected Software

1 affected componentFixes available

mageia/tomcat<9.0.123-1.mga10

9.0.123-1.mga10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade mageia/tomcat to a version that resolves this vulnerability.
Fixed in 9.0.123-1.mga10

Event History

Oct 30, 2026

Advisory Published

via OSV·01:10 AM

Data Sourced

via OSV·01:10 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

When was this advisory published and last updated?