Advisories » MGASA-2026-0568

Updated tomcat package fixes security vulnerabilities

Publication date: 30 Oct 2026
Modification date: 30 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-74048 , CVE-2026-74049 , CVE-2026-80353 , CVE-2026-88041 , CVE-2026-93446 , CVE-2026-101296 , CVE-2026-101356

Description

OpenSSL-FFM FIPS failure does not prevent start-up. (CVE-2026-74048)
Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE).
(CVE-2026-74049)
TOCTOU when setting specific permissions for Unix Domain Sockets - Fix
for CVE-2026-65183 did not address APR connector. (CVE-2026-80353)
HTTP/2 trailer header cross-contamination. (CVE-2026-88041)
Possible TLS 1.3 connection failures. (CVE-2026-93446)
JNDIRealm bind credential validation fails open for non-GSSAPI SASL
mechanisms. (CVE-2026-101296)
HTTP/2 request/response mix-up after error during async processing.
(CVE-2026-101356)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36554
• https://www.openwall.com/lists/oss-security/2026/10/20/21
• https://www.openwall.com/lists/oss-security/2026/10/20/22
• https://www.openwall.com/lists/oss-security/2026/10/20/23
• https://www.openwall.com/lists/oss-security/2026/10/20/24
• https://www.openwall.com/lists/oss-security/2026/10/20/25
• https://www.openwall.com/lists/oss-security/2026/10/20/26
• https://www.openwall.com/lists/oss-security/2026/10/20/27
• https://www.cve.org/CVERecord?id=CVE-2026-74048
• https://www.cve.org/CVERecord?id=CVE-2026-74049
• https://www.cve.org/CVERecord?id=CVE-2026-80353
• https://www.cve.org/CVERecord?id=CVE-2026-88041
• https://www.cve.org/CVERecord?id=CVE-2026-93446
• https://www.cve.org/CVERecord?id=CVE-2026-101296
• https://www.cve.org/CVERecord?id=CVE-2026-101356

SRPMS

10/core

• tomcat-9.0.123-1.mga10