{"id":"CLSA-2026-1786543355","summary":"Fix of 7 CVEs","details":"   * SECURITY UPDATE: fix for the following CVEs:\n     - CVE-2025-48989: MadeYouReset HTTP/2 DoS — charge the connection\n       overhead budget for server-initiated RST_STREAM frames in both\n       Http2UpgradeHandler and Http2AsyncUpgradeHandler, and apply the\n       initial HTTP/2 MAX_CONCURRENT_STREAMS and INITIAL_WINDOW_SIZE\n       limits immediately (force-set) rather than only after the client\n       ACKs the SETTINGS frame, closing the \"malformed control frame -\u003e\n       server RST\" amplification loop.\n     - CVE-2025-55752: RewriteValve query-string-append (QSA) path\n       traversal — swap the normalize/decode order in\n       RewriteValve.invoke() so the rewritten URL is URL-decoded before\n       normalisation, preventing encoded traversal sequences such as\n       %2F..%2F from surviving normalize() and later reaching /WEB-INF/\n       or /META-INF/.\n     - CVE-2026-29146: EncryptInterceptor padding oracle — validate the\n       configured cluster encryptionAlgorithm against an allow-list. GCM\n       is now only accepted with NoPadding; NONE, ECB, PCBC, CTS, KW, KWP\n       and CTR are refused outright, as are CBC, CFB and OFB with\n       NoPadding and CFB/OFB at a non-default block size (CFB8, OFB64,\n       ...); an unusable algorithm raises IllegalArgumentException at\n       startup instead of failing later.\n       CBC, CFB and OFB with PKCS5Padding continue to work but log a\n       warning recommending AES/GCM/NoPadding. The default\n       encryptionAlgorithm also changes from AES/CBC/PKCS5Padding to the\n       authenticated AES/GCM/NoPadding, which is what actually removes\n       the padding oracle for the deployments that never set the\n       attribute explicitly.\n       Rollout note: AES/GCM/NoPadding is not wire-compatible with\n       AES/CBC/PKCS5Padding, so nodes on the old and new defaults cannot\n       exchange cluster messages. The preferred procedure is to stop the\n       whole cluster and restart it on the new package. If a rolling\n       restart is unavoidable, first set\n       encryptionAlgorithm=\"AES/CBC/PKCS5Padding\" explicitly on every\n       node, roll the package out, then remove that setting everywhere\n       and restart once more. This pin is a rollout-window measure only\n       and must not be left in place: for as long as it is set the\n       cluster remains exposed to the padding oracle, and the fix is\n       complete only once it has been removed.","modified":"2026-10-26T09:31:40.146151561Z","published":"2026-08-20T10:41:55Z","upstream":["CVE-2025-48989","CVE-2025-55752","CVE-2026-29146"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1786543355.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24549"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34750"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50379"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52316"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48989"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55752"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29146"}],"affected":[{"package":{"name":"libtomcat9-embed-java","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libtomcat9-embed-java?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786543355.json"}},{"package":{"name":"libtomcat9-java","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libtomcat9-java?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786543355.json"}},{"package":{"name":"tomcat9","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/tomcat9?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786543355.json"}},{"package":{"name":"tomcat9-admin","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/tomcat9-admin?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786543355.json"}},{"package":{"name":"tomcat9-common","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/tomcat9-common?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786543355.json"}},{"package":{"name":"tomcat9-docs","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/tomcat9-docs?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786543355.json"}},{"package":{"name":"tomcat9-examples","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/tomcat9-examples?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786543355.json"}},{"package":{"name":"tomcat9-user","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/tomcat9-user?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786543355.json"}}],"schema_version":"1.9.0"}