{"id":"CLSA-2026-1780649787","summary":"Fix of 7 CVEs","details":"   * SECURITY UPDATE: fix the handling of invalid users with DIGEST authentication\n     - debian/patches/CVE-2026-43512.patch: fix the handling of invalid users with DIGEST authentication\n     - CVE-2026-43512\n   * SECURITY UPDATE: add case sensitive attribute to LockOutRealm\n     - debian/patches/CVE-2026-43513.patch: add case sensitive attribute to LockOutRealm\n     - CVE-2026-43513\n   * SECURITY UPDATE: switch AJP secret comparison to a constant time algorithm\n     - debian/patches/CVE-2026-43514.patch: switch AJP secret comparison to a constant time algorithm\n     - CVE-2026-43514\n   * SECURITY UPDATE: ensure RealmBase finds all matching extension based constraints\n     - debian/patches/CVE-2026-43515.patch: ensure RealmBase finds all matching extension based constraints\n     - CVE-2026-43515\n   * SECURITY UPDATE: add a configurable limit for WebDAV XML request bodies\n     - debian/patches/CVE-2026-41284.patch: add a configurable limit for WebDAV XML request bodies\n     - CVE-2026-41284\n   * SECURITY UPDATE: fix WebSocket + proxy + DIGEST auth on proxy\n     - debian/patches/CVE-2026-42498.patch: fix WebSocket + proxy + DIGEST auth on proxy\n     - CVE-2026-42498\n   * SECURITY UPDATE: HTTP/2 header filtering - validate decoded HPACK names/values against RFC 7230 token/field-vchar/field-content rules\n     - debian/patches/CVE-2026-41293.patch: HTTP/2 header filtering - validate decoded HPACK names/values against RFC 7230 token/field-vchar/field-content rules\n     - CVE-2026-41293\n   * Build: refresh debian/test_certs/ test fixtures (CA + RSA/EC server\n     certs + client cert) — upstream localhost-rsa.jks is expired since\n     2025-02-16 and 8.5.x is no longer rotated; new fixtures are signed\n     by a fresh self-signed CA with 10-year validity, applied via the\n     existing TEST_CERTS_DIR overlay in debian/rules.","modified":"2026-10-26T09:43:31.532100150Z","published":"2026-06-05T08:56:53Z","upstream":["CVE-2026-41284","CVE-2026-41293","CVE-2026-42498","CVE-2026-43512","CVE-2026-43513","CVE-2026-43514","CVE-2026-43515"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1780649787.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41284"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41293"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42498"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43512"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43513"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43514"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43515"}],"affected":[{"package":{"name":"libtomcat8-embed-java","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libtomcat8-embed-java?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1780649787.json"}},{"package":{"name":"libtomcat8-java","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libtomcat8-java?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1780649787.json"}},{"package":{"name":"tomcat8","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat8?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1780649787.json"}},{"package":{"name":"tomcat8-admin","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat8-admin?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1780649787.json"}},{"package":{"name":"tomcat8-common","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat8-common?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1780649787.json"}},{"package":{"name":"tomcat8-docs","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat8-docs?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1780649787.json"}},{"package":{"name":"tomcat8-examples","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat8-examples?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1780649787.json"}},{"package":{"name":"tomcat8-user","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat8-user?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1780649787.json"}}],"schema_version":"1.9.0"}