MGASA-2026-0479

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0479.html
Import Source
https://advisories.mageia.org/MGASA-2026-0479.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0479
Upstream
CVE (12)
  • CVE-2026-73581
  • CVE-2026-75973
  • CVE-2026-76183
  • CVE-2026-77756
  • CVE-2026-77762
  • CVE-2026-77791
  • CVE-2026-78383
  • CVE-2026-78437
  • CVE-2026-79677
  • CVE-2026-86248
  • CVE-2026-86350
  • CVE-2026-87022
Published
2026-10-09T17:00:24Z
Modified
2026-10-09T17:15:03Z
Summary
Updated tomcat package fixes security vulnerabilities
Details

OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. (CVE-2026-73581) Cross-context authentication mix-up with Jakarta Authentication configured. (CVE-2026-75973) Bypass of security constraints for WebSocket endpoints. (CVE-2026-76183) Transfer-Encoding honored for HTTP/1.0 requests. (CVE-2026-77756) Stale HPACK emitter injects trailers into recycled pooled Request. (CVE-2026-77762) DoS via busy wait during WebSocket close. (CVE-2026-77791) AJP DoS via missing request body. (CVE-2026-78383) HTTP/2 DoS via malformed request. (CVE-2026-78437) WebSocket DoS due to lost asynchronous write timeout. (CVE-2026-79677) Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled. (CVE-2026-86248) Regression in fix for CVE-2026-41293 can trigger request header mix-up. (CVE-2026-86350) WebSocket message smuggling with per-message-deflate. (CVE-2026-87022)

References
Credits

Affected packages

Mageia:10 / tomcat

Package

Name
tomcat
Purl
pkg:rpm/mageia/tomcat?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.0.122-1.mga10

Ecosystem specific 

{
    "section":  "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0479.json"