rpm package
opensuse/libtcnative-1-0&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/libtcnative-1-0&distro=openSUSE%20Leap%2016.0
Vulnerabilities (15)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-86247 | Hig | 7.4 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versio | |
| CVE-2026-86246 | Cri | 9.1 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native | |
| CVE-2026-86243 | Hig | 7.5 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be af | |
| CVE-2026-87022 | Hig | 7.5 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.1 | |
| CVE-2026-86350 | Cri | 9.1 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 th | |
| CVE-2026-86248 | Cri | 9.8 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recomme | |
| CVE-2026-79677 | Hig | 7.5 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, fro | |
| CVE-2026-78437 | Hig | 7.3 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.1 | |
| CVE-2026-78383 | Hig | 7.5 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1 | |
| CVE-2026-77791 | Hig | 7.5 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following version | |
| CVE-2026-77762 | Hig | 8.1 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 | |
| CVE-2026-77756 | Low | 3.7 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located be | |
| CVE-2026-76183 | Cri | 9.8 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. | |
| CVE-2026-75973 | Hig | 7.3 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be use | |
| CVE-2026-73581 | Med | 6.5 | < 1.3.9-160000.1.1 | 1.3.9-160000.1.1 | Sep 23, 2026 | Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9 |
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versio
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be af
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.1
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 th
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recomme
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, fro
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.1
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following version
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located be
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be use
- affected < 1.3.9-160000.1.1fixed 1.3.9-160000.1.1
Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9