Fix of 7 CVEs
* SECURITY UPDATE: Denial of service in HTTP/2 - a stream could be removed from the count of active streams more than once, driving the count below the real value, so an infinite connection timeout was applied and connections that should have been closed stayed open - debian/patches/CVE-2024-34750.patch: guard each stream with an AtomicBoolean so that it is removed from the active stream count at most once, and route the decrements through the new decrementActiveRemoteStreamCount(Stream) helper - CVE-2024-34750 * SECURITY UPDATE: Remote code execution via the write enabled default servlet - on a case insensitive file system a race between a read and a concurrent write for the same path allowed an uploaded file to be picked up and compiled as a JSP - debian/patches/CVE-2024-50379.patch: add the WebResourceLockSet interface and serialise reads and writes for the same resource path in DirResourceSet and FileResource through a per-path read/write lock - CVE-2024-50379 * SECURITY UPDATE: Authentication bypass when a custom Jakarta Authentication component throws an exception without setting an HTTP status, leaving the response status at 200 - debian/patches/CVE-2024-52316.patch: explicitly set a 500 status in authenticateJaspic() when validateRequest() throws an AuthException - CVE-2024-52316 * SECURITY UPDATE: Remote code execution via the write enabled default servlet - the mitigation for CVE-2024-50379 was incomplete because the JVM global canonical file name cache could still
- Products
- libtomcat9-embed-java, libtomcat9-java, tomcat9, tomcat9-admin, tomcat9-common, tomcat9-docs, tomcat9-examples, tomcat9-user
- Affected versions
- Not specified
- Fixed versions
- 9.0.31-1~deb10u12+tuxcare.els8
- CVEs
- CVE-2023-44487, CVE-2024-34750, CVE-2024-50379, CVE-2024-52316, CVE-2024-56337, CVE-2025-48989, CVE-2025-55752, CVE-2026-29146, CVE-2026-34486
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:45 UTC · Revision 1
Source evidence
* SECURITY UPDATE: Denial of service in HTTP/2 - a stream could be removed from the count of active streams more than once, driving the count below the real value, so an infinite connection timeout was applied and connections that should have been closed stayed open - debian/patches/CVE-2024-34750.patch: guard each stream with an AtomicBoolean so that it is removed from the active stream count at most once, and route the decrements through the new decrementActiveRemoteStreamCount(Stream) helper - CVE-2024-34750 * SECURITY UPDATE: Remote code execution via the write enabled default servlet - on a case insensitive file system a race between a read and a concurrent write for the same path allowed an uploaded file to be picked up and compiled as a JSP - debian/patches/CVE-2024-50379.patch: add the WebResourceLockSet interface and serialise reads and writes for the same resource path in DirResourceSet and FileResource through a per-path read/write lock - CVE-2024-50379 * SECURITY UPDATE: Authentication bypass when a custom Jakarta Authentication component throws an exception without setting an HTTP status, leaving the response status at 200 - debian/patches/CVE-2024-52316.patch: explicitly set a 500 status in authenticateJaspic() when validateRequest() throws an AuthException - CVE-2024-52316 * SECURITY UPDATE: Remote code execution via the write enabled default servlet - the mitigation for CVE-2024-50379 was incomplete because the JVM global canonical file name cache could still
osv:CLSA-2026-1786553162
libtomcat9-embed-java
Fixed versions: 9.0.31-1~deb10u12+tuxcare.els8
libtomcat9-java
Fixed versions: 9.0.31-1~deb10u12+tuxcare.els8
tomcat9
Fixed versions: 9.0.31-1~deb10u12+tuxcare.els8
tomcat9-admin
Fixed versions: 9.0.31-1~deb10u12+tuxcare.els8
tomcat9-common
Fixed versions: 9.0.31-1~deb10u12+tuxcare.els8
tomcat9-docs
Fixed versions: 9.0.31-1~deb10u12+tuxcare.els8
tomcat9-examples
Fixed versions: 9.0.31-1~deb10u12+tuxcare.els8
tomcat9-user
Fixed versions: 9.0.31-1~deb10u12+tuxcare.els8
Complete source record
{
"id": "1e0b148f52ac464620a4602a67eaf29ef000eba69c90343bcaf6296a63c0deeb",
"url": "https://osv.dev/vulnerability/CLSA-2026-1786553162",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Fix of 7 CVEs",
"summary": "* SECURITY UPDATE: Denial of service in HTTP/2 - a stream could be removed from the count of active streams more than once, driving the count below the real value, so an infinite connection timeout was applied and connections that should have been closed stayed open - debian/patches/CVE-2024-34750.patch: guard each stream with an AtomicBoolean so that it is removed from the active stream count at most once, and route the decrements through the new decrementActiveRemoteStreamCount(Stream) helper - CVE-2024-34750 * SECURITY UPDATE: Remote code execution via the write enabled default servlet - on a case insensitive file system a race between a read and a concurrent write for the same path allowed an uploaded file to be picked up and compiled as a JSP - debian/patches/CVE-2024-50379.patch: add the WebResourceLockSet interface and serialise reads and writes for the same resource path in DirResourceSet and FileResource through a per-path read/write lock - CVE-2024-50379 * SECURITY UPDATE: Authentication bypass when a custom Jakarta Authentication component throws an exception without setting an HTTP status, leaving the response status at 200 - debian/patches/CVE-2024-52316.patch: explicitly set a 500 status in authenticateJaspic() when validateRequest() throws an AuthException - CVE-2024-52316 * SECURITY UPDATE: Remote code execution via the write enabled default servlet - the mitigation for CVE-2024-50379 was incomplete because the JVM global canonical file name cache could still ",
"evidence": "osv:CLSA-2026-1786553162",
"products": [
{
"name": {
"value": "libtomcat9-embed-java",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.31-1~deb10u12+tuxcare.els8",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libtomcat9-java",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.31-1~deb10u12+tuxcare.els8",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat9",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.31-1~deb10u12+tuxcare.els8",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat9-admin",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.31-1~deb10u12+tuxcare.els8",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat9-common",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.31-1~deb10u12+tuxcare.els8",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat9-docs",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.31-1~deb10u12+tuxcare.els8",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat9-examples",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.31-1~deb10u12+tuxcare.els8",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat9-user",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.0.31-1~deb10u12+tuxcare.els8",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1786553162",
"aliases": [
"CLSA-2026-1786553162"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.31-1~deb10u12+tuxcare.els8"
}
]
}
],
"package": {
"name": "libtomcat9-embed-java",
"purl": "pkg:deb/tuxcare/libtomcat9-embed-java?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.31-1~deb10u12+tuxcare.els8"
}
]
}
],
"package": {
"name": "libtomcat9-java",
"purl": "pkg:deb/tuxcare/libtomcat9-java?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.31-1~deb10u12+tuxcare.els8"
}
]
}
],
"package": {
"name": "tomcat9",
"purl": "pkg:deb/tuxcare/tomcat9?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.31-1~deb10u12+tuxcare.els8"
}
]
}
],
"package": {
"name": "tomcat9-admin",
"purl": "pkg:deb/tuxcare/tomcat9-admin?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.31-1~deb10u12+tuxcare.els8"
}
]
}
],
"package": {
"name": "tomcat9-common",
"purl": "pkg:deb/tuxcare/tomcat9-common?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.31-1~deb10u12+tuxcare.els8"
}
]
}
],
"package": {
"name": "tomcat9-docs",
"purl": "pkg:deb/tuxcare/tomcat9-docs?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.31-1~deb10u12+tuxcare.els8"
}
]
}
],
"package": {
"name": "tomcat9-examples",
"purl": "pkg:deb/tuxcare/tomcat9-examples?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.31-1~deb10u12+tuxcare.els8"
}
]
}
],
"package": {
"name": "tomcat9-user",
"purl": "pkg:deb/tuxcare/tomcat9-user?distro=debian-10",
"ecosystem": "TuxCare:Debian:10"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"
}
}
],
"modified": "2026-10-26T09:43:13.621876886Z",
"provider": "osv",
"upstream": [
"CVE-2023-44487",
"CVE-2024-34750",
"CVE-2024-50379",
"CVE-2024-52316",
"CVE-2024-56337",
"CVE-2025-48989",
"CVE-2025-55752",
"CVE-2026-29146",
"CVE-2026-34486"
],
"references": [
"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1786553162.html",
"https://nvd.nist.gov/vuln/detail/CVE-2024-34750",
"https://nvd.nist.gov/vuln/detail/CVE-2024-50379",
"https://nvd.nist.gov/vuln/detail/CVE-2024-52316",
"https://nvd.nist.gov/vuln/detail/CVE-2024-56337",
"https://nvd.nist.gov/vuln/detail/CVE-2025-48989",
"https://nvd.nist.gov/vuln/detail/CVE-2025-55752",
"https://nvd.nist.gov/vuln/detail/CVE-2026-29146"
]
},
"related_cves": [
{
"value": "CVE-2023-44487",
"evidence": "/upstream"
},
{
"value": "CVE-2024-34750",
"evidence": "/upstream"
},
{
"value": "CVE-2024-50379",
"evidence": "/upstream"
},
{
"value": "CVE-2024-52316",
"evidence": "/upstream"
},
{
"value": "CVE-2024-56337",
"evidence": "/upstream"
},
{
"value": "CVE-2025-48989",
"evidence": "/upstream"
},
{
"value": "CVE-2025-55752",
"evidence": "/upstream"
},
{
"value": "CVE-2026-29146",
"evidence": "/upstream"
},
{
"value": "CVE-2026-34486",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 449768,
"published_at": "2026-08-12T16:46:19+00:00"
}