Security update for tomcat11

Announcement ID:	SUSE-SU-2026:1558-1
Release Date:	2026-04-22T16:24:40Z
Rating:	important
References:	bsc#1258371 bsc#1261850 bsc#1261851 bsc#1261852 bsc#1261853 bsc#1261854 bsc#1261855 bsc#1261856 bsc#1261857
Cross-References:	CVE-2025-66614 CVE-2026-24880 CVE-2026-25854 CVE-2026-29129 CVE-2026-29145 CVE-2026-29146 CVE-2026-32990 CVE-2026-34483 CVE-2026-34486 CVE-2026-34487 CVE-2026-34500
CVSS scores:	CVE-2025-66614 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVE-2025-66614 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2025-66614 ( NVD ): 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L CVE-2025-66614 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2026-24880 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVE-2026-24880 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2026-24880 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2026-25854 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVE-2026-25854 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2026-25854 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2026-29129 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVE-2026-29129 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2026-29129 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2026-29145 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVE-2026-29145 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2026-29145 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2026-29146 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVE-2026-29146 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2026-29146 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2026-32990 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2026-34483 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVE-2026-34483 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2026-34483 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2026-34486 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVE-2026-34486 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2026-34486 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2026-34487 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVE-2026-34487 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2026-34487 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2026-34500 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVE-2026-34500 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2026-34500 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected Products:	openSUSE Leap 15.6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server 15 SP6 LTSS SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Web and Scripting Module 15-SP7

An update that solves 11 vulnerabilities can now be installed.

Description:

This update for tomcat11 fixes the following issues:

Security fixes:

• CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
• CVE-2026-25854: Occasionally open redirect (bsc#1261851).
• CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
• CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
• CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
• CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
• CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856).
• CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
• CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

Other fixes:

• Update to Tomcat 11.0.21

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• openSUSE Leap 15.6
  zypper in -t patch SUSE-2026-1558=1
• Web and Scripting Module 15-SP7
  zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-1558=1
• SUSE Linux Enterprise Server 15 SP6 LTSS
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1558=1
• SUSE Linux Enterprise Server for SAP Applications 15 SP6
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1558=1

Package List:

• openSUSE Leap 15.6 (noarch)
  • tomcat11-jsp-4_0-api-11.0.21-150600.13.18.1
  • tomcat11-webapps-11.0.21-150600.13.18.1
  • tomcat11-embed-11.0.21-150600.13.18.1
  • tomcat11-jsvc-11.0.21-150600.13.18.1
  • tomcat11-lib-11.0.21-150600.13.18.1
  • tomcat11-doc-11.0.21-150600.13.18.1
  • tomcat11-11.0.21-150600.13.18.1
  • tomcat11-docs-webapp-11.0.21-150600.13.18.1
  • tomcat11-admin-webapps-11.0.21-150600.13.18.1
  • tomcat11-el-6_0-api-11.0.21-150600.13.18.1
  • tomcat11-servlet-6_1-api-11.0.21-150600.13.18.1
• Web and Scripting Module 15-SP7 (noarch)
  • tomcat11-jsp-4_0-api-11.0.21-150600.13.18.1
  • tomcat11-webapps-11.0.21-150600.13.18.1
  • tomcat11-lib-11.0.21-150600.13.18.1
  • tomcat11-11.0.21-150600.13.18.1
  • tomcat11-admin-webapps-11.0.21-150600.13.18.1
  • tomcat11-el-6_0-api-11.0.21-150600.13.18.1
  • tomcat11-servlet-6_1-api-11.0.21-150600.13.18.1
• SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
  • tomcat11-jsp-4_0-api-11.0.21-150600.13.18.1
  • tomcat11-webapps-11.0.21-150600.13.18.1
  • tomcat11-lib-11.0.21-150600.13.18.1
  • tomcat11-11.0.21-150600.13.18.1
  • tomcat11-admin-webapps-11.0.21-150600.13.18.1
  • tomcat11-el-6_0-api-11.0.21-150600.13.18.1
  • tomcat11-servlet-6_1-api-11.0.21-150600.13.18.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
  • tomcat11-jsp-4_0-api-11.0.21-150600.13.18.1
  • tomcat11-webapps-11.0.21-150600.13.18.1
  • tomcat11-lib-11.0.21-150600.13.18.1
  • tomcat11-11.0.21-150600.13.18.1
  • tomcat11-admin-webapps-11.0.21-150600.13.18.1
  • tomcat11-el-6_0-api-11.0.21-150600.13.18.1
  • tomcat11-servlet-6_1-api-11.0.21-150600.13.18.1

References:

• https://www.suse.com/security/cve/CVE-2025-66614.html
• https://www.suse.com/security/cve/CVE-2026-24880.html
• https://www.suse.com/security/cve/CVE-2026-25854.html
• https://www.suse.com/security/cve/CVE-2026-29129.html
• https://www.suse.com/security/cve/CVE-2026-29145.html
• https://www.suse.com/security/cve/CVE-2026-29146.html
• https://www.suse.com/security/cve/CVE-2026-32990.html
• https://www.suse.com/security/cve/CVE-2026-34483.html
• https://www.suse.com/security/cve/CVE-2026-34486.html
• https://www.suse.com/security/cve/CVE-2026-34487.html
• https://www.suse.com/security/cve/CVE-2026-34500.html
• https://bugzilla.suse.com/show_bug.cgi?id=1258371
• https://bugzilla.suse.com/show_bug.cgi?id=1261850
• https://bugzilla.suse.com/show_bug.cgi?id=1261851
• https://bugzilla.suse.com/show_bug.cgi?id=1261852
• https://bugzilla.suse.com/show_bug.cgi?id=1261853
• https://bugzilla.suse.com/show_bug.cgi?id=1261854
• https://bugzilla.suse.com/show_bug.cgi?id=1261855
• https://bugzilla.suse.com/show_bug.cgi?id=1261856
• https://bugzilla.suse.com/show_bug.cgi?id=1261857