{"id":"CLSA-2026-1786553162","summary":"Fix of 7 CVEs","details":"   * SECURITY UPDATE: Denial of service in HTTP/2 - a stream could be\n     removed from the count of active streams more than once, driving the\n     count below the real value, so an infinite connection timeout was\n     applied and connections that should have been closed stayed open\n     - debian/patches/CVE-2024-34750.patch: guard each stream with an\n       AtomicBoolean so that it is removed from the active stream count at\n       most once, and route the decrements through the new\n       decrementActiveRemoteStreamCount(Stream) helper\n     - CVE-2024-34750\n   * SECURITY UPDATE: Remote code execution via the write enabled default\n     servlet - on a case insensitive file system a race between a read and\n     a concurrent write for the same path allowed an uploaded file to be\n     picked up and compiled as a JSP\n     - debian/patches/CVE-2024-50379.patch: add the WebResourceLockSet\n       interface and serialise reads and writes for the same resource path\n       in DirResourceSet and FileResource through a per-path read/write\n       lock\n     - CVE-2024-50379\n   * SECURITY UPDATE: Authentication bypass when a custom Jakarta\n     Authentication component throws an exception without setting an HTTP\n     status, leaving the response status at 200\n     - debian/patches/CVE-2024-52316.patch: explicitly set a 500 status in\n       authenticateJaspic() when validateRequest() throws an AuthException\n     - CVE-2024-52316\n   * SECURITY UPDATE: Remote code execution via the write enabled default\n     servlet - the mitigation for CVE-2024-50379 was incomplete because\n     the JVM global canonical file name cache could still return a stale\n     result for the concurrently written path\n     - debian/patches/CVE-2024-56337.patch: disable the canonical file\n       name cache before a potentially exposed WebResourceSet starts and\n       refuse to start it if that cannot be confirmed, add Jre12Compat and\n       Jre21Compat for the per Java version cache behaviour, and pass\n       -Dsun.io.useCanonCaches=false from catalina.sh\n     - CVE-2024-56337\n   * SECURITY UPDATE: Denial of service in HTTP/2 (MadeYouReset) - frames\n     that make the server reset a stream were not counted against the\n     connection overhead budget, so the CVE-2023-44487 mitigation never\n     triggered\n     - debian/patches/CVE-2025-48989.patch: count every RST_STREAM frame\n       Tomcat sends using overheadResetFactor\n     - CVE-2025-48989\n   * SECURITY UPDATE: Directory traversal via the RewriteValve, with\n     possible remote code execution if PUT is enabled - the rewritten URL\n     was normalized while still percent encoded, so an encoded ../\n     survived normalization and was decoded afterwards, letting the\n     request escape into /WEB-INF/ or /META-INF/\n     - debian/patches/CVE-2025-55752.patch: decode the rewritten URL\n       before normalizing it, and reject the request with a 400 when\n       normalization reports that the path escapes root\n     - CVE-2025-55752\n   * SECURITY UPDATE: Padding oracle in the cluster EncryptInterceptor -\n     the interceptor accepted cipher mode and padding combinations that\n     offer no protection, and the CBC modes it accepted are malleable and\n     open to a padding oracle\n     - debian/patches/CVE-2026-29146.patch: reject the cipher mode and\n       padding combinations that offer no protection, warn for the CBC,\n       CFB and OFB modes with PKCS5Padding that are kept for\n       compatibility, and recognise GCM/NoPadding as the recommended\n       transformation. The patch also carries the upstream partial revert\n       776e12b3, without which the fix would reintroduce CVE-2026-34486\n       by passing messages that failed to decrypt up the interceptor\n       chain with their raw bytes. Note that, as upstream, explicit\n       EncryptInterceptor configurations using a mode that offers no\n       protection (NONE, ECB, PCBC, CTS, KW, KWP, CTR, and CBC, CFB or OFB\n       with NoPadding) are now rejected at startup. The default\n       AES/CBC/PKCS5Padding keeps working and only logs a recommendation\n       to switch to AES/GCM/NoPadding\n     - CVE-2026-29146","modified":"2026-10-26T09:43:13.621876886Z","published":"2026-08-12T16:46:19Z","upstream":["CVE-2023-44487","CVE-2024-34750","CVE-2024-50379","CVE-2024-52316","CVE-2024-56337","CVE-2025-48989","CVE-2025-55752","CVE-2026-29146","CVE-2026-34486"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1786553162.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34750"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50379"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52316"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56337"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48989"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55752"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29146"}],"affected":[{"package":{"name":"libtomcat9-embed-java","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libtomcat9-embed-java?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"}},{"package":{"name":"libtomcat9-java","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libtomcat9-java?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"}},{"package":{"name":"tomcat9","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/tomcat9?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"}},{"package":{"name":"tomcat9-admin","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/tomcat9-admin?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"}},{"package":{"name":"tomcat9-common","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/tomcat9-common?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"}},{"package":{"name":"tomcat9-docs","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/tomcat9-docs?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"}},{"package":{"name":"tomcat9-examples","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/tomcat9-examples?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"}},{"package":{"name":"tomcat9-user","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/tomcat9-user?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786553162.json"}}],"schema_version":"1.9.0"}