The Apache Software Foundationから、Apache Tomcatの10件の脆弱性に対してアドバイザリが公開されました。 Fixed in Apache Tomcat 11.0.25Fixed in Apache Tomcat 10.1.59Fixed in Apache Tomcat 9.0.121
Apache Software Foundation Apache Tomcat
Apache Tomcatのアドバイザリを参照してください。
Apache Software Foundation The Apache Software Foundation : [SECURITY] CVE-2026-65182 Apache Tomcat - Security constraint bypass The Apache Software Foundation : [SECURITY] CVE-2026-65183 Apache Tomcat - TOCTOU when setting specific permissions for Unix Domain Sockets The Apache Software Foundation : [SECURITY] CVE-2026-65637 Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation The Apache Software Foundation : [SECURITY] CVE-2026-65927 Apache Tomcat - RewriteValve [N] restarts at the second rule and may bypass access control The Apache Software Foundation : [SECURITY] CVE-2026-65905 Apache Tomcat - Limited replay attack possible with DIGEST authentication The Apache Software Foundation : [SECURITY] CVE-2026-66422 Apache Tomcat - Servlet role references can bypass declarative role constraints The Apache Software Foundation : [SECURITY] CVE-2026-68525 Apache Tomcat - Redirect after FORM authentication may bypass method specific constraints The Apache Software Foundation : [SECURITY] CVE-2026-73180 Apache Tomcat - Authenticated WebSocket session survives end of HTTP session The Apache Software Foundation : [SECURITY] CVE-2026-68569 Apache Tomcat - Principal lookup can fail open in some cases The Apache Software Foundation : [SECURITY] CVE-2026-68763 Apache Tomcat - DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
CVE-2026-65182 CVE-2026-65183 CVE-2026-65637 CVE-2026-65905 CVE-2026-65927 CVE-2026-66422 CVE-2026-68525 CVE-2026-68569 CVE-2026-68763 CVE-2026-73180
JVN : JVNVU#96149019
[2026年08月27日] 掲載
