CLSA-2026-1786121727
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1786121727.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1786121727
- Upstream
- Published
- 2026-08-07T16:55:45Z
- Modified
- 2026-10-26T09:30:31Z
- Summary
- tomcat: Fix of 8 CVEs
- Details
-
- CVE-2026-24880: validate HTTP/1.1 chunk extensions with a new ChunkExtension state machine instead of skipping them unparsed, so a CRLF embedded in a quoted extension value can no longer desync Tomcat from a front-end proxy and smuggle a request
- CVE-2026-25854: collapse leading slashes on the request URI and redirect via sendRedirect in the LoadBalancerDrainingValve so a protocol-relative URI can no longer be reflected into the Location header as an open redirect
- CVE-2026-34483: escape the request URI and query string in the access log %r, %q and %U elements so log fields cannot be forged through unescaped output
- CVE-2026-34487: stop logging the Kubernetes bearer token by dropping it from the tokenStream.failedConnection message and dropping the request headers from the cloud stream provider debug log
- References
-
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1786121727.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-61795
- https://nvd.nist.gov/vuln/detail/CVE-2026-24880
- https://nvd.nist.gov/vuln/detail/CVE-2026-25854
- https://nvd.nist.gov/vuln/detail/CVE-2026-34483
- https://nvd.nist.gov/vuln/detail/CVE-2026-34487
- https://nvd.nist.gov/vuln/detail/CVE-2026-50229
- https://nvd.nist.gov/vuln/detail/CVE-2026-53404
- https://nvd.nist.gov/vuln/detail/CVE-2026-55955