Security update for tomcat11 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2026:0877-1 Final 1 1 2026-03-12T05:39:40Z current 2026-03-12T05:39:40Z 2026-03-12T05:39:40Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tomcat11 This update for tomcat11 fixes the following issues: Update to Tomcat 11.0.18: - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371). - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385). - CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387). Changelog: * Catalina + Fix: 69932: Fix request end access log pattern regression, which would log the start time of the request instead. (remm) + Fix: 69623: Additional fix for the long standing regression that meant that calls to ClassLoader.getResource().getContent() failed when made from within a web application with resource caching enabled if the target resource was packaged in a JAR file. (markt) + Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the CsrfPreventionFilter. (schultz) + Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2 requests when the content-length header is not set. (dsoumis) + Update: Enable minimum and recommended Tomcat Native versions to be set separately for Tomcat Native 1.x and 2.x. Update the minimum and recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum and recommended versions for Tomcat Native 2.x to 2.0.12. (markt) + Add: Add a new ssoReauthenticationMode to the Tomcat provided Authenticators that provides a per Authenticator override of the SSO Valve requireReauthentication attribute. (markt) + Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception rather than silently using a replacement character. (markt) + Fix: 69871: Increase log level to INFO for missing configuration for the rewrite valve. (remm) + Fix: Add log warnings for additional Host appBase suspicious values. (remm) + Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar. org.apache.catalina.Connector no longer requires org.apache.tomcat.jni.AprStatus to be present. (markt) + Add: Add the ability to use a custom function to generate the client identifier in the CrawlerSessionManagerValve. This is only available programmatically. Pull request #902 by Brian Matzon. (markt) + Fix: Change the SSO reauthentication behaviour for SPNEGO authentication so that a normal SPNEGO authentication is performed if the SSL Valve is configured with reauthentication enabled. This is so that the delegated credentials will be available to the web application. (markt) + Fix: When generating the class path in the Loader, re-order the check on individual class path components to avoid a potential NullPointerException. Identified by Coverity Scan. (markt) + Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull request #915 by Joshua Rogers. (remm) + Update: Add an attribute, digestInRfc3112Order, to MessageDigestCredentialHandler to control the order in which the credential and salt are digested. By default, the current, non-RFC 3112 compliant, order of salt then credential will be used. This default will change in Tomcat 12 to the RFC 3112 compliant order of credential then salt. (markt) * Cluster + Add: 62814: Document that human-readable names may be used for mapSendOptions and align documentation with channelSendOptions. Based on pull request #929 by archan0621. (markt) * Clustering + Fix: Correct a regression introduced in 11.0.11 that broke some clustering configurations. (markt) * Coyote + Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown that triggered a significant memory leak. Patch provided by Wes. (markt) + Fix: Prevent concurrent release of OpenSSLEngine resources and the termination of the Tomcat Native library as it can cause crashes during Tomcat shutdown. (markt) + Fix: Improve warnings when setting ciphers lists in the FFM code, mirroring the tomcat-native changes. (remm) + Fix: 69910: Dereference TLS objects right after closing a socket to improve memory efficiency. (remm) + Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig to reflect the existing implementation that allows one configuration style to be used for the trust attributes and a different style for all the other attributes. (markt) + Fix: Better warning message when OpenSSLConf configuration elements are used with a JSSE TLS implementation. (markt) + Fix: When using OpenSSL via FFM, don't log a warning about missing CA certificates unless CA certificates were configured and the configuration failed. (markt) + Add: For configuration consistency between OpenSSL and JSSE TLS implementations, TLSv1.3 cipher suites included in the ciphers attribute of an SSLHostConfig are now always ignored (previously they would be ignored with OpenSSL implementations and used with JSSE implementations) and a warning is logged that the cipher suite has been ignored. (markt) + Add: Add the ciphersuite attribute to SSLHostConfig to configure the TLSv1.3 cipher suites. (markt) + Add: Add OCSP support to JSSE based TLS connectors and make the use of OCSP configurable per connector for both JSSE and OpenSSL based TLS implementations. Align the checks performed by OpenSSL with those performed by JSSE. (markt) + Add: Add support for soft failure of OCSP checks with soft failure support disabled by default. (markt) + Add: Add support for configuring the verification flags passed to OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt) + Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5. + Fix: Don't log an incorrect certificate KeyStore location when creating a TLS connector if the KeyStore instance has been set directly on the connector. (markt) + Fix: HTTP/0.9 only allows GET as the HTTP method. (remm) + Add: Add strictSni attribute on the Connector to allow matching the SSLHostConfig configuration associated with the SNI host name to the SSLHostConfig configuration matched from the HTTP protocol host name. Non matching configurations will cause the request to be rejected. The attribute default value is true, enabling the matching. (remm) + Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm) + Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL provider. Pull request #912 by aogburn. (markt) + Fix: Fix potential crash on shutdown when a Connector depends on the Tomcat Native library. (markt) + Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers. * Jasper + Fix: 69333: Correct a regression in the previous fix for 69333 and ensure that reuse() or release() is always called for a tag. (markt) + Fix: 69877: Catch IllegalArgumentException when processing URIs when creating the classpath to handle invalid URIs. (remm) + Fix: Fix populating the classpath with the webapp classloader repositories. (remm) + Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some exception details. Patch submitted by Eric Blanquer. (remm) * Jdbc-pool + Fix: 64083: If the underlying connection has been closed, don't add it to the pool when it is returned. Pull request #235 by Alex Panchenko. (markt) * Web applications + Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server status output if one or more of the web applications failed to start. (schultz) + Add: Manager: Include web application state in the HTML and JSON complete server status output. (markt) + Add: Documentation: Expand the documentation to better explain when OCSP is supported and when it is not. (markt) * Websocket + Fix: 69920: When attempting to write to a closed Writer or OutputStream obtained from a WebSocket session, throw an IOException rather than an IllegalStateExcpetion as required by Writer and strongly suggested by OutputStream. (markt) * Other + Add: Add property 'gpg.sign.files' to optionally disable release artefact signing with GPG. (rjung) + Add: Add test.silent property to suppress JUnit console output during test execution. Useful for cleaner console output when running tests with multiple threads. (csutherl) + Update: Update the internal fork of Commons Pool to 2.13.1. (markt) + Update: Update the internal fork of Commons DBCP to 2.14.0. (markt) + Update: Update Commons Daemon to 1.5.1. (markt) + Update: Update to the Eclipse JDT compiler 4.37. (markt) + Update: Update ByteBuddy to 1.18.3. (markt) + Update: Update UnboundID to 7.0.4. (markt) + Update: Update Checkstyle to 12.3.1. (markt) + Add: Improvements to French translations. (markt) + Add: Improvements to Japanese translations provided by tak7iji. (markt) + Add: Improvements to Chinese translations provided by Yang. vincent.h and yong hu. (markt) + Update: Update Tomcat Native to 2.0.12. (markt) + Add: Add test profile system for selective test execution. Profiles can be specified via -Dtest.profile=<name> to run specific test subsets without using patterns directly. Profile patterns are defined in test-profiles.properties. (csutherl) + Update: Update file extension to media type mappings to align with the current list used by the Apache Web Server (httpd). (markt) + Update: Update the packaged version of the Tomcat Migration Tool for Jakarta EE to 1.0.10. (markt) + Update: Update Commons Daemon to 1.5.0. (markt) + Update: Update Byte Buddy to 1.18.2. (markt) + Update: Update Checkstyle to 12.2.0. (markt) + Add: Improvements to Spanish translations provided by White Vogel. (markt) + Add: Improvements to French translations. (remm) + Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt) + Update: Update to Byte Buddy 1.17.8. (markt) + Update: Update to Checkstyle 12.1.1. (markt) + Update: Update to Jacoco 0.8.14. (markt) + Update: Update to SpotBugs 4.9.8. (markt) + Update: Update to JSign 7.4. (markt) + Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2026-877,SUSE-SLE-Module-Web-Scripting-15-SP7-2026-877,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-877,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-877,openSUSE-SLE-15.6-2026-877 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2026/suse-su-20260877-1/ Link for SUSE-SU-2026:0877-1 https://lists.suse.com/pipermail/sle-security-updates/2026-March/024680.html E-Mail link for SUSE-SU-2026:0877-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1253460 SUSE Bug 1253460 https://bugzilla.suse.com/1258371 SUSE Bug 1258371 https://bugzilla.suse.com/1258385 SUSE Bug 1258385 https://bugzilla.suse.com/1258387 SUSE Bug 1258387 https://www.suse.com/security/cve/CVE-2025-66614/ SUSE CVE CVE-2025-66614 page https://www.suse.com/security/cve/CVE-2026-24733/ SUSE CVE CVE-2026-24733 page https://www.suse.com/security/cve/CVE-2026-24734/ SUSE CVE CVE-2026-24734 page SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP6 openSUSE Leap 15.6 tomcat11-11.0.18-150600.13.15.1 tomcat11-admin-webapps-11.0.18-150600.13.15.1 tomcat11-doc-11.0.18-150600.13.15.1 tomcat11-docs-webapp-11.0.18-150600.13.15.1 tomcat11-el-6_0-api-11.0.18-150600.13.15.1 tomcat11-embed-11.0.18-150600.13.15.1 tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 tomcat11-jsvc-11.0.18-150600.13.15.1 tomcat11-lib-11.0.18-150600.13.15.1 tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 tomcat11-webapps-11.0.18-150600.13.15.1 tomcat11-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 tomcat11-admin-webapps-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 tomcat11-el-6_0-api-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 tomcat11-lib-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 tomcat11-webapps-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7 tomcat11-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS tomcat11-admin-webapps-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS tomcat11-el-6_0-api-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS tomcat11-lib-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS tomcat11-webapps-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server 15 SP6-LTSS tomcat11-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 tomcat11-admin-webapps-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 tomcat11-el-6_0-api-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 tomcat11-lib-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 tomcat11-webapps-11.0.18-150600.13.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP6 tomcat11-11.0.18-150600.13.15.1 as a component of openSUSE Leap 15.6 tomcat11-admin-webapps-11.0.18-150600.13.15.1 as a component of openSUSE Leap 15.6 tomcat11-doc-11.0.18-150600.13.15.1 as a component of openSUSE Leap 15.6 tomcat11-docs-webapp-11.0.18-150600.13.15.1 as a component of openSUSE Leap 15.6 tomcat11-el-6_0-api-11.0.18-150600.13.15.1 as a component of openSUSE Leap 15.6 tomcat11-embed-11.0.18-150600.13.15.1 as a component of openSUSE Leap 15.6 tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 as a component of openSUSE Leap 15.6 tomcat11-jsvc-11.0.18-150600.13.15.1 as a component of openSUSE Leap 15.6 tomcat11-lib-11.0.18-150600.13.15.1 as a component of openSUSE Leap 15.6 tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 as a component of openSUSE Leap 15.6 tomcat11-webapps-11.0.18-150600.13.15.1 as a component of openSUSE Leap 15.6 Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field. The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue. CVE-2025-66614 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-admin-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-el-6_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-lib-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-admin-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-lib-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-webapps-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-doc-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-embed-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-jsvc-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-lib-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-webapps-11.0.18-150600.13.15.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260877-1/ https://www.suse.com/security/cve/CVE-2025-66614.html CVE-2025-66614 https://bugzilla.suse.com/1258371 SUSE Bug 1258371 Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112. Older, EOL versions are also affected. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue. CVE-2026-24733 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-admin-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-el-6_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-lib-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-admin-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-lib-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-webapps-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-doc-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-embed-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-jsvc-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-lib-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-webapps-11.0.18-150600.13.15.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260877-1/ https://www.suse.com/security/cve/CVE-2026-24733.html CVE-2026-24733 https://bugzilla.suse.com/1258385 SUSE Bug 1258385 Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue. CVE-2026-24734 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-admin-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-el-6_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-lib-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-admin-webapps-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-lib-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-webapps-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-doc-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-embed-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-jsvc-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-lib-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1 openSUSE Leap 15.6:tomcat11-webapps-11.0.18-150600.13.15.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260877-1/ https://www.suse.com/security/cve/CVE-2026-24734.html CVE-2026-24734 https://bugzilla.suse.com/1258387 SUSE Bug 1258387