tomcat: Fix of 10 CVEs
- CVE-2026-65183: create and validate the parent directory of a unix domain socket before binding the socket to it, with configurable required parent directory permissions and an expected parent directory owner, and factor the non-POSIX permission handling out into its own helper, so that another local user can no longer win the race between the bind and the point at which the socket permissions are applied and thereby gain access to the socket - CVE-2026-66422: resolve a security-role-ref alias only in Request.isUserInRole(), and look the Context role mapping up in RealmBase.hasRole() through the wrapper's parent Context, rather than conflating the two lookups in StandardWrapper.findSecurityReference(), so that a security-role-ref declared by a servlet is no longer honoured as a role alias when the realm authorises a request - CVE-2026-68525: recompute the security constraints, the proxy caching headers and the user data constraint after FORM authentication has restored the original request, whenever the method of that restored request differs from the method of the login submission, so that a user who is permitted to POST to a resource but not to GET it can no longer reach it with a GET by driving the request through the FORM login flow
- Products
- tomcat, tomcat-admin-webapps, tomcat-docs-webapp, tomcat-el-3.0-api, tomcat-jsp-2.3-api, tomcat-lib, tomcat-servlet-4.0-api, tomcat-webapps
- Affected versions
- Not specified
- Fixed versions
- 1:9.0.62-12.el9_2.1.tuxcare.els13
- CVEs
- CVE-2026-65183, CVE-2026-66422, CVE-2026-68525
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 10:44 UTC · Revision 1
Source evidence
- CVE-2026-65183: create and validate the parent directory of a unix domain socket before binding the socket to it, with configurable required parent directory permissions and an expected parent directory owner, and factor the non-POSIX permission handling out into its own helper, so that another local user can no longer win the race between the bind and the point at which the socket permissions are applied and thereby gain access to the socket - CVE-2026-66422: resolve a security-role-ref alias only in Request.isUserInRole(), and look the Context role mapping up in RealmBase.hasRole() through the wrapper's parent Context, rather than conflating the two lookups in StandardWrapper.findSecurityReference(), so that a security-role-ref declared by a servlet is no longer honoured as a role alias when the realm authorises a request - CVE-2026-68525: recompute the security constraints, the proxy caching headers and the user data constraint after FORM authentication has restored the original request, whenever the method of that restored request differs from the method of the login submission, so that a user who is permitted to POST to a resource but not to GET it can no longer reach it with a GET by driving the request through the FORM login flow
osv:CLSA-2026-1788273808
tomcat
Fixed versions: 1:9.0.62-12.el9_2.1.tuxcare.els13
tomcat-admin-webapps
Fixed versions: 1:9.0.62-12.el9_2.1.tuxcare.els13
tomcat-docs-webapp
Fixed versions: 1:9.0.62-12.el9_2.1.tuxcare.els13
tomcat-el-3.0-api
Fixed versions: 1:9.0.62-12.el9_2.1.tuxcare.els13
tomcat-jsp-2.3-api
Fixed versions: 1:9.0.62-12.el9_2.1.tuxcare.els13
tomcat-lib
Fixed versions: 1:9.0.62-12.el9_2.1.tuxcare.els13
tomcat-servlet-4.0-api
Fixed versions: 1:9.0.62-12.el9_2.1.tuxcare.els13
tomcat-webapps
Fixed versions: 1:9.0.62-12.el9_2.1.tuxcare.els13
Complete source record
{
"id": "582f422917b4c68601c2a0bff9c73b2a0a53f87b6eb1d078dccacdc9809fd871",
"url": "https://osv.dev/vulnerability/CLSA-2026-1788273808",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "tomcat: Fix of 10 CVEs",
"summary": "- CVE-2026-65183: create and validate the parent directory of a unix domain socket before binding the socket to it, with configurable required parent directory permissions and an expected parent directory owner, and factor the non-POSIX permission handling out into its own helper, so that another local user can no longer win the race between the bind and the point at which the socket permissions are applied and thereby gain access to the socket - CVE-2026-66422: resolve a security-role-ref alias only in Request.isUserInRole(), and look the Context role mapping up in RealmBase.hasRole() through the wrapper's parent Context, rather than conflating the two lookups in StandardWrapper.findSecurityReference(), so that a security-role-ref declared by a servlet is no longer honoured as a role alias when the realm authorises a request - CVE-2026-68525: recompute the security constraints, the proxy caching headers and the user data constraint after FORM authentication has restored the original request, whenever the method of that restored request differs from the method of the login submission, so that a user who is permitted to POST to a resource but not to GET it can no longer reach it with a GET by driving the request through the FORM login flow",
"evidence": "osv:CLSA-2026-1788273808",
"products": [
{
"name": {
"value": "tomcat",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:9.0.62-12.el9_2.1.tuxcare.els13",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat-admin-webapps",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:9.0.62-12.el9_2.1.tuxcare.els13",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat-docs-webapp",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:9.0.62-12.el9_2.1.tuxcare.els13",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat-el-3.0-api",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:9.0.62-12.el9_2.1.tuxcare.els13",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat-jsp-2.3-api",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:9.0.62-12.el9_2.1.tuxcare.els13",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat-lib",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:9.0.62-12.el9_2.1.tuxcare.els13",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat-servlet-4.0-api",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:9.0.62-12.el9_2.1.tuxcare.els13",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tomcat-webapps",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:9.0.62-12.el9_2.1.tuxcare.els13",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1788273808",
"aliases": [
"CLSA-2026-1788273808"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:9.0.62-12.el9_2.1.tuxcare.els13"
}
]
}
],
"package": {
"name": "tomcat",
"purl": "pkg:rpm/tuxcare/tomcat?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788273808.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:9.0.62-12.el9_2.1.tuxcare.els13"
}
]
}
],
"package": {
"name": "tomcat-admin-webapps",
"purl": "pkg:rpm/tuxcare/tomcat-admin-webapps?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788273808.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:9.0.62-12.el9_2.1.tuxcare.els13"
}
]
}
],
"package": {
"name": "tomcat-docs-webapp",
"purl": "pkg:rpm/tuxcare/tomcat-docs-webapp?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788273808.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:9.0.62-12.el9_2.1.tuxcare.els13"
}
]
}
],
"package": {
"name": "tomcat-el-3.0-api",
"purl": "pkg:rpm/tuxcare/tomcat-el-3.0-api?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788273808.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:9.0.62-12.el9_2.1.tuxcare.els13"
}
]
}
],
"package": {
"name": "tomcat-jsp-2.3-api",
"purl": "pkg:rpm/tuxcare/tomcat-jsp-2.3-api?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788273808.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:9.0.62-12.el9_2.1.tuxcare.els13"
}
]
}
],
"package": {
"name": "tomcat-lib",
"purl": "pkg:rpm/tuxcare/tomcat-lib?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788273808.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:9.0.62-12.el9_2.1.tuxcare.els13"
}
]
}
],
"package": {
"name": "tomcat-servlet-4.0-api",
"purl": "pkg:rpm/tuxcare/tomcat-servlet-4.0-api?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788273808.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:9.0.62-12.el9_2.1.tuxcare.els13"
}
]
}
],
"package": {
"name": "tomcat-webapps",
"purl": "pkg:rpm/tuxcare/tomcat-webapps?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788273808.json"
}
}
],
"modified": "2026-10-26T09:30:44.497801532Z",
"provider": "osv",
"upstream": [
"CVE-2026-65183",
"CVE-2026-66422",
"CVE-2026-68525"
],
"references": [
"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788273808.html",
"https://nvd.nist.gov/vuln/detail/CVE-2026-32990",
"https://nvd.nist.gov/vuln/detail/CVE-2026-65182",
"https://nvd.nist.gov/vuln/detail/CVE-2026-65183",
"https://nvd.nist.gov/vuln/detail/CVE-2026-65905",
"https://nvd.nist.gov/vuln/detail/CVE-2026-65927",
"https://nvd.nist.gov/vuln/detail/CVE-2026-66422",
"https://nvd.nist.gov/vuln/detail/CVE-2026-68525",
"https://nvd.nist.gov/vuln/detail/CVE-2026-68569",
"https://nvd.nist.gov/vuln/detail/CVE-2026-68763",
"https://nvd.nist.gov/vuln/detail/CVE-2026-73180"
]
},
"related_cves": [
{
"value": "CVE-2026-65183",
"evidence": "/upstream"
},
{
"value": "CVE-2026-66422",
"evidence": "/upstream"
},
{
"value": "CVE-2026-68525",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 447208,
"published_at": "2026-10-06T15:44:31+00:00"
}