MGASA-2026-0568

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0568.html
Import Source
https://advisories.mageia.org/MGASA-2026-0568.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0568
Upstream
CVE (7)
  • CVE-2026-101296
  • CVE-2026-101356
  • CVE-2026-74048
  • CVE-2026-74049
  • CVE-2026-80353
  • CVE-2026-88041
  • CVE-2026-93446
Published
2026-10-30T01:10:00Z
Modified
2026-10-30T01:28:17Z
Summary
Updated tomcat package fixes security vulnerabilities
Details

OpenSSL-FFM FIPS failure does not prevent start-up. (CVE-2026-74048) Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE). (CVE-2026-74049) TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector. (CVE-2026-80353) HTTP/2 trailer header cross-contamination. (CVE-2026-88041) Possible TLS 1.3 connection failures. (CVE-2026-93446) JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms. (CVE-2026-101296) HTTP/2 request/response mix-up after error during async processing. (CVE-2026-101356)

References
Credits

Affected packages

Mageia:10 / tomcat

Package

Name
tomcat
Purl
pkg:rpm/mageia/tomcat?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.0.123-1.mga10

Ecosystem specific 

{
    "section":  "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0568.json"