MGASA-2026-0095

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0095.html
Import Source
https://advisories.mageia.org/MGASA-2026-0095.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0095
Upstream
  • CVE-2026-24880
  • CVE-2026-25854
  • CVE-2026-29129
  • CVE-2026-29145
  • CVE-2026-29146
  • CVE-2026-32990
  • CVE-2026-34483
  • CVE-2026-34486
  • CVE-2026-34487
  • CVE-2026-34500
Published
2026-04-12T05:23:15Z
Modified
2026-04-16T04:41:56.116698475Z
Summary
Updated tomcat packages fix security vulnerabilities
Details

Request smuggling via invalid chunk extension. (CVE-2026-24880) Occasionally open redirect. (CVE-2026-25854) TLS cipher order is not preserved. (CVE-2026-29129) OCSP checks sometimes soft-fail even when soft-fail is disabled. (CVE-2026-29145) EncryptInterceptor vulnerable to padding oracle attack by default. (CVE-2026-29146) Fix for CVE-2025-66614 is incomplete. (CVE-2026-32990) Incomplete escaping of JSON access logs. (CVE-2026-34483) Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor. (CVE-2026-34486) Cloud membership for clustering component exposed the Kubernetes bearer token. (CVE-2026-34487) OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled. (CVE-2026-34500)

References
Credits

Affected packages

Mageia:9 / tomcat

Package

Name
tomcat
Purl
pkg:rpm/mageia/tomcat?arch=source&distro=mageia-9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.117-1.mga9

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0095.json"