{"id":"SUSE-SU-2026:3418-1","summary":"Security update for tomcat10","details":"This update for tomcat10 fixes the following issues:\n\nUpdate to Tomcat 10.1.57.\n\nSecurity issues fixed:\n\n- CVE-2026-59083: incorrect URL decoding in `RewriteValve` may allow security control bypass (bsc#1271397).\n- CVE-2026-59084: `EncryptInterceptor` requirements are not clearly documented (bsc#1271398).\n\nOther updates and bugfixes:\n\n- Tomcat 10.1.57:\n  * Catalina\n    + Fix: Avoid a race condition with concurrent lookups for a singleton JNDI\n      resource. (markt)\n    + Fix: Improve the performance of range validation for the default\n      servlet. (markt)\n    + Fix: Avoid NPE in RewriteValve. (markt)\n    + Fix: 70127: Fix use of Bootstrap through reflection by restoring the\n      public constructor. Use through scripts was not affected. (remm)\n    + Fix: Restore ability to extend many element classes from\n      AbstractAccessLogValve. (remm)\n    + Fix: Align DIGEST authentication with RFC 7616 and require clients to\n      provide a valid qop parameter. (markt)\n    + Fix: Use Files API to create temporary docBase when antiLockingDocBase\n      is enabled. (markt)\n    + Fix: Improve validation of configuration when DataSourceRealm starts.\n      (remm)\n    + Fix: JAASRealm should do a logout if login does not fail outright but\n      does not produce a Principal. (remm)\n    + Fix: Various edge cases for SSI substitutions, quoting and escaping.\n      (remm)\n    + Fix: unintentional conversion of literal + to a space during rule\n      processing in the RewriteValve. (markt)\n  * Coyote\n    + Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native\n      is not available when the connector is explicitly configured to use\n      Tomcat Native with OpenSSL for TLS. (markt)\n  * Jasper\n    + Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix\n      for 69333) was incomplete and tags that threw exceptions in doStartTag()\n      and doEndTag() were incorrectly re-used. This fix prevents tags from\n      being re-used if such an exception occurs. (markt)\n    + Fix: 70135: Fix security classload regression. (remm)\n    + Add: support for specifying Java 28 (with the value 28) as the compiler\n      source and/or compiler target for JSP compilation. If used with an\n      Eclipse JDT compiler version that does not support these values, a\n      warning will be logged and the default will be used. (markt)\n  * WebSocket\n    + Fix: 70126: Fix WebSocket extension permessage-deflate so that it does\n      not drop bytes if a compressed message inflates to more than the\n      available buffer. Fix written by GPT-5.5. Test case written by Hironori\n      Ichimiya. (markt)\n    + Fix: Optimise WebSocket client processing of server responses during\n      WebSocket HTTP upgrade process. (markt)\n  * Other\n    + Update: Byte Buddy to 1.18.9. (markt)\n    + Update: UnboundID to 7.0.5. (markt)\n    + Update: JaCoCo to 0.8.15. (markt)\n    + Update: BND to 7.3.0. (markt)\n    + Add: Improvements to French translations. (remm)\n    + Add: Improvements to Japanese translations provided by tak7iji. (markt)\n","modified":"2026-07-30T17:15:08.820907912Z","published":"2026-07-30T07:07:42Z","related":["CVE-2026-59083","CVE-2026-59084"],"upstream":["CVE-2026-59083","CVE-2026-59084"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263418-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271397"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271398"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59083"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59084"}],"affected":[{"package":{"name":"tomcat10","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","purl":"pkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.57-150200.5.73.1"}]}],"ecosystem_specific":{"binaries":[{"tomcat10-jsp-3_1-api":"10.1.57-150200.5.73.1","tomcat10-lib":"10.1.57-150200.5.73.1","tomcat10-servlet-6_0-api":"10.1.57-150200.5.73.1","tomcat10-webapps":"10.1.57-150200.5.73.1","tomcat10":"10.1.57-150200.5.73.1","tomcat10-admin-webapps":"10.1.57-150200.5.73.1","tomcat10-el-5_0-api":"10.1.57-150200.5.73.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3418-1.json"}},{"package":{"name":"tomcat10","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","purl":"pkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.57-150200.5.73.1"}]}],"ecosystem_specific":{"binaries":[{"tomcat10-lib":"10.1.57-150200.5.73.1","tomcat10-servlet-6_0-api":"10.1.57-150200.5.73.1","tomcat10-webapps":"10.1.57-150200.5.73.1","tomcat10":"10.1.57-150200.5.73.1","tomcat10-admin-webapps":"10.1.57-150200.5.73.1","tomcat10-el-5_0-api":"10.1.57-150200.5.73.1","tomcat10-jsp-3_1-api":"10.1.57-150200.5.73.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3418-1.json"}},{"package":{"name":"tomcat10","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","purl":"pkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.57-150200.5.73.1"}]}],"ecosystem_specific":{"binaries":[{"tomcat10-servlet-6_0-api":"10.1.57-150200.5.73.1","tomcat10-webapps":"10.1.57-150200.5.73.1","tomcat10":"10.1.57-150200.5.73.1","tomcat10-admin-webapps":"10.1.57-150200.5.73.1","tomcat10-el-5_0-api":"10.1.57-150200.5.73.1","tomcat10-jsp-3_1-api":"10.1.57-150200.5.73.1","tomcat10-lib":"10.1.57-150200.5.73.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3418-1.json"}},{"package":{"name":"tomcat10","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","purl":"pkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.57-150200.5.73.1"}]}],"ecosystem_specific":{"binaries":[{"tomcat10-webapps":"10.1.57-150200.5.73.1","tomcat10":"10.1.57-150200.5.73.1","tomcat10-admin-webapps":"10.1.57-150200.5.73.1","tomcat10-el-5_0-api":"10.1.57-150200.5.73.1","tomcat10-jsp-3_1-api":"10.1.57-150200.5.73.1","tomcat10-lib":"10.1.57-150200.5.73.1","tomcat10-servlet-6_0-api":"10.1.57-150200.5.73.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3418-1.json"}},{"package":{"name":"tomcat10","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.57-150200.5.73.1"}]}],"ecosystem_specific":{"binaries":[{"tomcat10-el-5_0-api":"10.1.57-150200.5.73.1","tomcat10-jsp-3_1-api":"10.1.57-150200.5.73.1","tomcat10-lib":"10.1.57-150200.5.73.1","tomcat10-servlet-6_0-api":"10.1.57-150200.5.73.1","tomcat10-webapps":"10.1.57-150200.5.73.1","tomcat10":"10.1.57-150200.5.73.1","tomcat10-admin-webapps":"10.1.57-150200.5.73.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3418-1.json"}},{"package":{"name":"tomcat10","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","purl":"pkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.57-150200.5.73.1"}]}],"ecosystem_specific":{"binaries":[{"tomcat10-servlet-6_0-api":"10.1.57-150200.5.73.1","tomcat10-webapps":"10.1.57-150200.5.73.1","tomcat10":"10.1.57-150200.5.73.1","tomcat10-admin-webapps":"10.1.57-150200.5.73.1","tomcat10-el-5_0-api":"10.1.57-150200.5.73.1","tomcat10-jsp-3_1-api":"10.1.57-150200.5.73.1","tomcat10-lib":"10.1.57-150200.5.73.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3418-1.json"}},{"package":{"name":"tomcat10","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/tomcat10&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.57-150200.5.73.1"}]}],"ecosystem_specific":{"binaries":[{"tomcat10-jsp-3_1-api":"10.1.57-150200.5.73.1","tomcat10-lib":"10.1.57-150200.5.73.1","tomcat10-servlet-6_0-api":"10.1.57-150200.5.73.1","tomcat10-webapps":"10.1.57-150200.5.73.1","tomcat10":"10.1.57-150200.5.73.1","tomcat10-admin-webapps":"10.1.57-150200.5.73.1","tomcat10-el-5_0-api":"10.1.57-150200.5.73.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3418-1.json"}}],"schema_version":"1.8.0"}