SUSE-SU-2026:5116-1

This update for tomcat fixes the following issues:

• CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure (bsc#1286502).
• CVE-2026-74049: Jasper JSTL <c:redirect> plug-in implementation omits page abort (bsc#1286555).
• CVE-2026-80353: TOCTOU when creating unix domain sockets for the APR/Native connector allows an unauthorized local user to access the unix domain socket (bsc#1286902).
• CVE-2026-88041: Information disclosure via incomplete HTTP trailer cleanup (bsc#1286559).
• CVE-2026-93446: Possible TLS 1.3 connection failures (bsc#1286571).
• CVE-2026-101296: Authentication bypass via non-GSSAPI SASL in JNDI realm (bsc#1286361).
• CVE-2026-101356: Information disclosure via incorrect object recycling in HTTP/2 processing (bsc#1286362).

Changes for tomcat:

Update to Tomcat 9.0.123:

• Catalina
  • Fix: When starting a web application, don't try and use the web application class loader until after the web application class loader has started. (markt)
  • Fix: various concurrency issues around adding and removing Realms from a CombinedRealm, in particular doing so while the CombinedRealm is in use. Note that once a Realm instance has been removed from a CombinedRealm instance at run-time, the removed Realm instance may not be reused apart from re-adding it to the same CombinedRealm. (markt)
  • Update: When StoreConfig re-writes an existing server.xml or context configuration file, preserve the layout of the existing file (comments, blank lines and attribute order) on a best effort basis. (remm)
  • Fix: Track in StandardContext whether the context was deployed from a Context element in server.xml. Use it to have StoreConfig save to a new config file. (remm)
  • Fix: Improve error handling on start-up. (markt)
  • Fix: byte range responses generated by DefaultServlet so a short resource stream read does not truncate the response. Treat a premature end of stream as an I/O error. Based on pull request #1067 by aoto-tech. (markt)
  • Fix: Align OpenSSLLifecycleListener with AprLifecycleListener and throw an Error when FIPS is requested but not available. (markt)
  • Fix: Ensure that, as per the documentation, a simple bind is always used when the JNDI realm binds using the user provided name and password to authenticate the user. (markt)
  • Update: Optimize Accept-Language header processing and use of resource budles for localization. (remm)
• Coyote
  • Fix: 70236: Fix a stalled TLS handshake with the OpenSSL based implementations of SSLEngine when the first flight of handshake messages sent by the server is too large to fit in the buffer used by the BIO pair. Patch submitted by Lukas Hellebrandt. (remm)
  • Fix: #1073: Fix possible corruption when using HTTP/2 and async IO on uploads. Submitted by Tim Burke. (remm)
  • Fix: Avoid very rare race between async write notification and completion. Skip the write notification in these cases since it would be useless. (remm)
  • Fix: a timing issue that could cause large non-blocking writes to stall for AJP connections. (markt)
  • Fix: Ensure that the non-blocking write buffer is empty before sending an AJP end response message. (markt)
  • Fix: CharChunk.indexOf(char) so that it searches from the start of the chunk rather than from twice the chunk's start offset when the chunk does not begin at the start of its buffer. (breken-ai)
  • Fix: 70247: Fix a leak in the HTTP/2 connection flow control window when part of the HTTP request body is received but not read. Based on a patch provided by Guillaume Darmont. (markt)
  • Fix: 70251: Avoid closing a JarFile in CloseableURLConnection unless it is certain the JAR is not shared. (remm)
  • Fix: possible corruption of HTTP/1.1 chunked response bodies if a previous write to a chunked body fails. (markt)
  • Fix: Align cipher order with the results produced by OpenSSL if the cipher specification adds, removes and then re-adds ciphers. (markt)
  • Add: new attributes (unixDomainSocketParentPermissions and unixDomainSocketParentOwner) to the APR/Native connector to provide additional control over the security of Unix Domain Sockets. Additional checks (enabled by default) have also been added for the directory where the Unix Domain Socket will be created.(markt)
  • Fix: Correct a narrow race condition when processing HTTP/2 headers. (markt)
  • Fix: possible TLS connections failures caused by one of the flags Tomcat uses to track TLS handshake progress not being correctly reset. (markt)
  • Fix: Allow for absolute host names in SNI checks. (markt)
  • Fix: Correct a gap in asynchronous error handling that could lead to unexpected IllegalStateExceptions for some error conditions. (markt)
  • Add: Harden HTTP/2 against applications that do not correctly handle asynchronous errors. (markt)
• Jasper
  • Fix: Route JspC servlet context logging through Ant when used as an Ant task. (sainadh777)
  • Fix: the tag plugin for the JSTL c:redirtect tag so that page processing ends with the redirect. (markt)
• Web applications
  • Add: Documentation: Explicitly state that virtual host matching via the HTTP host header and TLS configuration matching via SNI are completely separate processes. (markt)
  • Fix: Examples: Draw axis-aligned rectangles and ellipses as lines in the WebSocket drawboard. (sainadh777)
• Other
  • Update: the internal fork of Apache Commons BCEL to 6.13.0. (markt)
  • Update: to NSIS 3.13. (markt)
  • Update: to Byte Buddy 1.18.14. (markt)
  • Update: to Bouncy Castle 1.8.6. (markt)
  • Add: Improvements to French translations. (remm)
  • Add: Improvements to Japanese translations provided by tak7iji. (markt)
• Cluster
  • Fix: Replicate SSO session key set changes made by removeSession() and sessionChangedId() in ClusterSingleSignOn so that SSO entries are correctly deregistered and removed from all nodes when the last associated session expires, even when the sessions expire on different cluster nodes. (remm)
  • Fix: Move context attributes that were set while the web application was still starting into the replicated attribute map when it is installed in ReplicatedContext, so that they are replicated to the other nodes like attributes set later on rather than remaining local to the node that started the application. (remm)
  • Fix: a possible deadlock in DeltaSession.expire(): the final session delta is now captured and sent to the cluster before the session monitor is acquired, because obtaining the delta takes the delta lock and code that runs while the delta lock is held, such as session attribute listener notifications, may in turn wait for the session monitor. (remm)
  • Fix: Fire the documented send_message_failure lifecycle event with the message, destination and exception when a SimpleTcpCluster message send fails and notifyLifecycleListenerOnFailure is enabled. The event was previously declared but never fired. (remm)
  • Fix: a possible deadlock in DeltaSession: session attribute listeners are no longer called while the delta lock is held when attributes are set or removed. The delta lock is only held while the change is recorded. (markt)
  • Fix: a possible deadlock in DeltaSession: received session deltas are now read into a separate DeltaRequest from the one the session uses to record local changes. This avoids having to hold the delta lock while processing received changes. (markt)
  • Fix: Move context attributes that were set while the web application was still starting into the replicated attribute map when it is installed in ReplicatedContext, so that they are replicated to the other nodes like attributes set later on rather than remaining local to the node that started the application. (remm)
  • Fix: an issue replicating SessionListener additions and removals that meant some modification were not replicated leading to inconsistent listener configurations across the cluster. (markt)
• Tribes
  • Docs: Document Tribes channel, membership, transport and replication status available through JMX. Based on pull request #1071 by sainadh777. (markt)