Security update for tomcat
| Announcement ID: | SUSE-SU-2026:1058-1 |
|---|---|
| Release Date: | 2026-03-26T09:46:50Z |
| Rating: | important |
| References: | |
| Cross-References: |
|
| CVSS scores: |
|
| Affected Products: |
|
An update that solves 43 vulnerabilities can now be installed.
Description:
This update for tomcat fixes the following issues:
Update to Tomcat 9.0.115:
- CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to "MadeYouReset" DoS attack (bsc#1243895).
- CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash (bsc#1246389).
- CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
- CVE-2023-44487: Rapid reset attack (bsc#1216182).
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Server 12 SP5 LTSS
zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-1058=1 -
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-1058=1
Package List:
-
SUSE Linux Enterprise Server 12 SP5 LTSS (noarch)
- tomcat-el-3_0-api-9.0.115-3.160.1
- tomcat-docs-webapp-9.0.115-3.160.1
- tomcat-jsp-2_3-api-9.0.115-3.160.1
- tomcat-javadoc-9.0.115-3.160.1
- tomcat-admin-webapps-9.0.115-3.160.1
- tomcat-servlet-4_0-api-9.0.115-3.160.1
- tomcat-lib-9.0.115-3.160.1
- tomcat-webapps-9.0.115-3.160.1
- tomcat-9.0.115-3.160.1
-
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch)
- tomcat-el-3_0-api-9.0.115-3.160.1
- tomcat-docs-webapp-9.0.115-3.160.1
- tomcat-jsp-2_3-api-9.0.115-3.160.1
- tomcat-javadoc-9.0.115-3.160.1
- tomcat-admin-webapps-9.0.115-3.160.1
- tomcat-servlet-4_0-api-9.0.115-3.160.1
- tomcat-lib-9.0.115-3.160.1
- tomcat-webapps-9.0.115-3.160.1
- tomcat-9.0.115-3.160.1
References:
- https://www.suse.com/security/cve/CVE-2020-13934.html
- https://www.suse.com/security/cve/CVE-2020-13935.html
- https://www.suse.com/security/cve/CVE-2020-13943.html
- https://www.suse.com/security/cve/CVE-2020-17527.html
- https://www.suse.com/security/cve/CVE-2021-24122.html
- https://www.suse.com/security/cve/CVE-2021-25122.html
- https://www.suse.com/security/cve/CVE-2021-25329.html
- https://www.suse.com/security/cve/CVE-2021-30640.html
- https://www.suse.com/security/cve/CVE-2021-33037.html
- https://www.suse.com/security/cve/CVE-2021-41079.html
- https://www.suse.com/security/cve/CVE-2021-43980.html
- https://www.suse.com/security/cve/CVE-2022-23181.html
- https://www.suse.com/security/cve/CVE-2022-42252.html
- https://www.suse.com/security/cve/CVE-2023-24998.html
- https://www.suse.com/security/cve/CVE-2023-28708.html
- https://www.suse.com/security/cve/CVE-2023-28709.html
- https://www.suse.com/security/cve/CVE-2023-41080.html
- https://www.suse.com/security/cve/CVE-2023-42795.html
- https://www.suse.com/security/cve/CVE-2023-44487.html
- https://www.suse.com/security/cve/CVE-2023-45468.html
- https://www.suse.com/security/cve/CVE-2023-46589.html
- https://www.suse.com/security/cve/CVE-2024-21733.html
- https://www.suse.com/security/cve/CVE-2024-23672.html
- https://www.suse.com/security/cve/CVE-2024-24549.html
- https://www.suse.com/security/cve/CVE-2024-34750.html
- https://www.suse.com/security/cve/CVE-2024-38286.html
- https://www.suse.com/security/cve/CVE-2024-50379.html
- https://www.suse.com/security/cve/CVE-2024-52316.html
- https://www.suse.com/security/cve/CVE-2024-54677.html
- https://www.suse.com/security/cve/CVE-2025-24813.html
- https://www.suse.com/security/cve/CVE-2025-31651.html
- https://www.suse.com/security/cve/CVE-2025-46701.html
- https://www.suse.com/security/cve/CVE-2025-48988.html
- https://www.suse.com/security/cve/CVE-2025-48989.html
- https://www.suse.com/security/cve/CVE-2025-49125.html
- https://www.suse.com/security/cve/CVE-2025-52434.html
- https://www.suse.com/security/cve/CVE-2025-52520.html
- https://www.suse.com/security/cve/CVE-2025-53506.html
- https://www.suse.com/security/cve/CVE-2025-55752.html
- https://www.suse.com/security/cve/CVE-2025-55754.html
- https://www.suse.com/security/cve/CVE-2025-61795.html
- https://www.suse.com/security/cve/CVE-2025-66614.html
- https://www.suse.com/security/cve/CVE-2026-24733.html
- https://bugzilla.suse.com/show_bug.cgi?id=1216182
- https://bugzilla.suse.com/show_bug.cgi?id=1243895
- https://bugzilla.suse.com/show_bug.cgi?id=1246318
- https://bugzilla.suse.com/show_bug.cgi?id=1246389
- https://bugzilla.suse.com/show_bug.cgi?id=1258371
- https://bugzilla.suse.com/show_bug.cgi?id=1258385
- https://bugzilla.suse.com/show_bug.cgi?id=1259224