Apache Tomcat: Mehrere Schwachstellen
WID-SEC-2026-1514 · first 13.05.2026 · updated 13.10.2026 · CVSS 9,8
What it is about
Apache Tomcat ist ein Web-Applikationsserver für verschiedene Plattformen. Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen oder andere, nicht spezifizierte bezeichnete Angriffe durchzuführen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- Sicherheitsmaßnahmen zu umgehen
- vertrauliche Informationen offenzulegen
- Daten zu manipulieren
- einen Denial-of-Service-Zustand herbeizuführen oder andere
- nicht spezifizierte bezeichnete Angriffe durchzuführen
Am I affected?
Affected according to the BSI:
- Dell NetWorker
- Debian Linux
- Amazon Linux 2
- IBM Power Hardware Management Console
- Red Hat Enterprise Linux
- Ubuntu Linux
- SUSE Linux
- IBM QRadar SIEM
- SUSE openSUSE
- Dell Avamar
- Broadcom Brocade SANnav
- Apache Tomcat <9.0.118
and 6 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Apache Tomcat 9.0.118
- Apache Tomcat 10.1.55
- Apache Tomcat 11.0.22
- Dell Secure Connect Gateway 5.36.00.16
- Absolute Secure Access 14.60
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- SUSE Security Update SUSE-SU-2026:2675-1 vom 2026-06-29 lists.suse.com
- openSUSE Security Update OPENSUSE-SU-2026:21122-1 vom 2026-06-30 lists.opensuse.org
- openSUSE Security Update OPENSUSE-SU-2026:21117-1 vom 2026-06-30 lists.opensuse.org
- openSUSE Security Update OPENSUSE-SU-2026:21121-1 vom 2026-06-30 lists.opensuse.org
- IBM Security Bulletin 7278738 vom 2026-07-01 www.ibm.com
- Tomcat 9.0.118 Changelog vom 2026-05-12 tomcat.apache.org
- Tomcat 10.1.55 Changelog vom 2026-05-12 tomcat.apache.org
- Tomcat 11.0.22 Changelog vom 2026-05-12 tomcat.apache.org
- CVE-2026-41284: Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling vom 2026-05-12 seclists.org
- CVE-2026-41293: Apache Tomcat: HTTP/2 request headers not validated vom 2026-05-12 seclists.org
- CVE-2026-42498: Apache Tomcat: WebSocket authentication header exposure vom 2026-05-12 seclists.org
- CVE-2026-43512: Apache Tomcat: Digest authenticator will authenticate any unknown user vom 2026-05-12 seclists.org
- CVE-2026-43513: Apache Tomcat: LockOutRealm treats user names as case-sensitive vom 2026-05-12 seclists.org
- CVE-2026-43514: Apache Tomcat: AJP secret compared in non-constant time vom 2026-05-12 seclists.org
- CVE-2026-43515: Apache Tomcat: Security constraints not correctly applied vom 2026-05-12 seclists.org
- Red Hat Security Advisory RHSA-2026:13745 vom 2026-05-28 access.redhat.com
- Red Hat Security Advisory RHSA-2026:16528 vom 2026-05-28 access.redhat.com
- openSUSE Security Update OPENSUSE-SU-2026:10926-1 vom 2026-06-05 lists.opensuse.org
- openSUSE Security Update OPENSUSE-SU-2026:10927-1 vom 2026-06-05 lists.opensuse.org
- Debian Security Advisory DLA-4619 vom 2026-06-07 lists.debian.org
- openSUSE Security Update OPENSUSE-SU-2026:10925-1 vom 2026-06-05 lists.opensuse.org
- Amazon Linux Security Advisory ALAS2TOMCAT9-2026-026 vom 2026-06-08 alas.aws.amazon.com
- SUSE Security Update SUSE-SU-2026:2299-1 vom 2026-06-08 lists.suse.com
- Debian Security Advisory DSA-6329 vom 2026-06-08 security-tracker.debian.org
- Debian Security Advisory DSA-6328 vom 2026-06-08 security-tracker.debian.org
and 38 more sources in the original advisory
CVE: CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.