{"id":"CLSA-2026-1786359337","summary":"Fix of 8 CVEs","details":"   * SECURITY UPDATE: HTTP/2 header limit errors deferred until whole header block read\n     - debian/patches/CVE-2024-24549.patch: validate headers after each HEADERS/CONTINUATION payload instead of only at end of block in java/org/apache/coyote/http2/Http2Parser.java, and swap the header emitter to the sink once validation fails in java/org/apache/coyote/http2/{Stream,Http2UpgradeHandler}.java\n     - CVE-2024-24549\n   * SECURITY UPDATE: HTTP/2 active stream miscount leading to infinite connection timeout\n     - debian/patches/CVE-2024-34750.patch: count each stream out of the active set exactly once in java/org/apache/coyote/http2/{Http2UpgradeHandler,Http2AsyncUpgradeHandler,Stream}.java\n     - CVE-2024-34750\n   * SECURITY UPDATE: RCE via TOCTOU race in write-enabled default servlet on case insensitive file systems\n     - debian/patches/CVE-2024-50379.patch: add path-keyed read/write locking via the new java/org/apache/catalina/WebResourceLockSet.java and use it in java/org/apache/catalina/webresources/{DirResourceSet,FileResource}.java\n     - CVE-2024-50379\n   * SECURITY UPDATE: incomplete mitigation for CVE-2024-50379 on Java 8 and Java 11\n     - debian/patches/CVE-2024-56337.patch: set -Dsun.io.useCanonCaches=false before any file system access in bin/catalina.sh\n     - CVE-2024-56337\n   * SECURITY UPDATE: authentication bypass when a Jakarta Authentication component throws\n     - debian/patches/CVE-2024-52316.patch: set a 500 status when validateRequest() throws AuthException in java/org/apache/catalina/authenticator/AuthenticatorBase.java\n     - CVE-2024-52316\n   * SECURITY UPDATE: HTTP/2 denial of service via client triggered server side stream resets\n     - debian/patches/CVE-2025-48989.patch: charge server initiated resets to the overhead counter in java/org/apache/coyote/http2/{Http2UpgradeHandler,Http2AsyncUpgradeHandler}.java\n     - CVE-2025-48989\n   * SECURITY UPDATE: directory traversal via Rewrite Valve normalizing before decoding\n     - debian/patches/CVE-2025-55752.patch: decode the rewritten URL before normalizing it in java/org/apache/catalina/valves/rewrite/RewriteValve.java\n     - CVE-2025-55752\n   * SECURITY UPDATE: EncryptInterceptor padding oracle from the CBC default\n     - debian/patches/CVE-2026-29146.patch: reject cipher modes that provide no protection and warn on the weaker ones in java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java; AES/GCM/PKCS5Padding, AES/CBC/NoPadding, AES/CFB/NoPadding and AES/OFB/NoPadding are now refused at startup\n     - CVE-2026-29146","modified":"2026-10-26T09:43:33.048913023Z","published":"2026-08-10T10:55:54Z","upstream":["CVE-2024-24549","CVE-2024-34750","CVE-2024-50379","CVE-2024-52316","CVE-2024-56337","CVE-2025-48989","CVE-2025-55752","CVE-2026-29146"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1786359337.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24549"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34750"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50379"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52316"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56337"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48989"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55752"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29146"}],"affected":[{"package":{"name":"libtomcat9-embed-java","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libtomcat9-embed-java?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1786359337.json"}},{"package":{"name":"libtomcat9-java","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libtomcat9-java?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1786359337.json"}},{"package":{"name":"tomcat9","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat9?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1786359337.json"}},{"package":{"name":"tomcat9-admin","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat9-admin?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1786359337.json"}},{"package":{"name":"tomcat9-common","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat9-common?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1786359337.json"}},{"package":{"name":"tomcat9-docs","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat9-docs?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1786359337.json"}},{"package":{"name":"tomcat9-examples","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat9-examples?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1786359337.json"}},{"package":{"name":"tomcat9-user","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat9-user?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1786359337.json"}}],"schema_version":"1.9.0"}