# CVE-2026-29146: tomcat: This update for tomcat fixes the following issues:  Security fixes:  - CVE-2026-24880: Request smuggling via invalid...

CVE-2026-29146 is fixed in 30 products on 1 platform, first by RHSA-2026:36787, released April 9, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-29146
- Priority: High
- CVSS: 7.5 (high)
- EPSS: 0.0885
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 9, 2026

## Description

This update for tomcat fixes the following issues:  Security fixes:  - CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850). - CVE-2026-25854: Occasionally open redirect (bsc#1261851). - CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852). - CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853). - CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854). - CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).   - CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token (bsc#1261856). - CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857). - CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).  Other fixes:  - Update to Tomcat 9.0.117

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | jws6-tomcat RHEL 10 | 10.1.49-13.redhat_00011.1.el10jws | [RHSA-2026:20405](https://patchblox.com/security/data/fix/linux/rhsa-2026-20405.md) | Apr 9, 2026 |
| Linux | jws7-tomcat RHEL 10 | 11.0.21-5.redhat_00004.1.el10jws | [RHSA-2026:39188](https://patchblox.com/security/data/fix/linux/rhsa-2026-39188.md) | Jul 18, 2026 |
| Linux | tomcat RHEL 10 | 10.1.36-2.el10_0 | [RHSA-2026:36787](https://patchblox.com/security/data/fix/linux/rhsa-2026-36787.md) | Apr 9, 2026 |
| Linux | tomcat RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat opensuse-leap 16.0 | 9.0.117-160000.1.1 | [OPENSUSE-SU-2026:20611-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20611-1.md) | Apr 22, 2026 |
| Linux | tomcat rocky 10 | 1:10.1.49-3.el10_2 | [RLSA-2026:36788](https://patchblox.com/security/data/fix/linux/rlsa-2026-36788.md) | Jul 10, 2026 |
| Linux | tomcat rocky 8 | 1:9.0.87-2.el8_10 | [RLSA-2026:37137](https://patchblox.com/security/data/fix/linux/rlsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat rocky 9 | 1:9.0.117-2.el9_8 | [RLSA-2026:36879](https://patchblox.com/security/data/fix/linux/rlsa-2026-36879.md) | Jul 10, 2026 |
| Linux | tomcat sles 15.6 | 9.0.117-150200.105.1 | [SUSE-SU-2026:1604-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1604-1.md) | Apr 24, 2026 |
| Linux | tomcat sles 15.7 | 9.0.117-150200.105.1 | [SUSE-SU-2026:1604-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1604-1.md) | Apr 24, 2026 |
| Linux | tomcat-admin-webapps RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-admin-webapps RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-admin-webapps almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-admin-webapps almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-admin-webapps almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-admin-webapps ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-admin-webapps ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-admin-webapps ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-docs-webapp RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-docs-webapp RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-docs-webapp almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-docs-webapp almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-docs-webapp almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-docs-webapp ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-docs-webapp ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-docs-webapp ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-el-3.0-api RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-el-3.0-api RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-el-3.0-api almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-el-3.0-api almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-el-3.0-api ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-el-3.0-api ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-el-5.0-api almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-el-5.0-api ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-jsp-2.3-api RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-jsp-2.3-api RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-jsp-2.3-api almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-jsp-2.3-api almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-jsp-2.3-api ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-jsp-2.3-api ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-jsp-3.1-api almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-jsp-3.1-api ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-lib RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-lib RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-lib almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-lib almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-lib almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-lib ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-lib ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-lib ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-servlet-4.0-api RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-servlet-4.0-api RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-servlet-4.0-api almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-servlet-4.0-api almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-servlet-4.0-api ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-servlet-4.0-api ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-servlet-6.0-api almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-servlet-6.0-api ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-webapps RHEL 8 | 1:9.0.87-2.el8_10 | [RHSA-2026:37137](https://patchblox.com/security/data/fix/linux/rhsa-2026-37137.md) | Jul 10, 2026 |
| Linux | tomcat-webapps RHEL 9 | 1:9.0.117-2.el9_8 | [RHSA-2026:36879](https://patchblox.com/security/data/fix/linux/rhsa-2026-36879.md) | Jul 9, 2026 |
| Linux | tomcat-webapps almalinux 10 | 1:10.1.49-3.el10_2.alma.1 | [ALSA-2026:36788](https://patchblox.com/security/data/fix/linux/alsa-2026-36788.md) | Jul 8, 2026 |
| Linux | tomcat-webapps almalinux 8 | 1:9.0.87-2.el8_10 | [ALSA-2026:37137](https://patchblox.com/security/data/fix/linux/alsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-webapps almalinux 9 | 1:9.0.117-2.el9_8 | [ALSA-2026:36879](https://patchblox.com/security/data/fix/linux/alsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat-webapps ol 10 | 1:10.1.49-3.el10_2 | [ELSA-2026-36788](https://patchblox.com/security/data/fix/linux/elsa-2026-36788.md) | Jul 16, 2026 |
| Linux | tomcat-webapps ol 8 | 1:9.0.87-2.el8_10 | [ELSA-2026-37137](https://patchblox.com/security/data/fix/linux/elsa-2026-37137.md) | Jul 9, 2026 |
| Linux | tomcat-webapps ol 9 | 1:9.0.117-2.el9_8 | [ELSA-2026-36879](https://patchblox.com/security/data/fix/linux/elsa-2026-36879.md) | Jul 8, 2026 |
| Linux | tomcat10 Debian 12.15 (bookworm) | 10.1.55-1~deb12u1 | [DEBIAN-CVE-2026-29146](https://patchblox.com/security/data/fix/linux/debian-cve-2026-29146.md) | Apr 9, 2026 |
| Linux | tomcat10 Debian 13.5 (trixie) | 10.1.55-1~deb13u1 | [DEBIAN-CVE-2026-29146](https://patchblox.com/security/data/fix/linux/debian-cve-2026-29146.md) | Apr 9, 2026 |
| Linux | tomcat10 Debian 14 | 10.1.54-1 | [DEBIAN-CVE-2026-29146](https://patchblox.com/security/data/fix/linux/debian-cve-2026-29146.md) | Apr 9, 2026 |
| Linux | tomcat10 amzn 2023 | 1:10.1.54-1.amzn2023.0.1 | [ALAS2023-2026-1673](https://patchblox.com/security/data/fix/linux/alas2023-2026-1673.md) | May 11, 2026 |
| Linux | tomcat10 opensuse-leap 16.0 | 10.1.54-160000.1.1 | [OPENSUSE-SU-2026:20612-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20612-1.md) | Apr 22, 2026 |
| Linux | tomcat10 sles 15.6 | 10.1.54-150200.5.64.1 | [SUSE-SU-2026:1603-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1603-1.md) | Apr 24, 2026 |
| Linux | tomcat10 sles 15.7 | 10.1.54-150200.5.64.1 | [SUSE-SU-2026:1603-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1603-1.md) | Apr 24, 2026 |
| Linux | tomcat10-admin-webapps amzn 2023 | 1:10.1.54-1.amzn2023.0.1 | [ALAS2023-2026-1673](https://patchblox.com/security/data/fix/linux/alas2023-2026-1673.md) | May 11, 2026 |
| Linux | tomcat10-docs-webapp amzn 2023 | 1:10.1.54-1.amzn2023.0.1 | [ALAS2023-2026-1673](https://patchblox.com/security/data/fix/linux/alas2023-2026-1673.md) | May 11, 2026 |
| Linux | tomcat10-el-5.0-api amzn 2023 | 1:10.1.54-1.amzn2023.0.1 | [ALAS2023-2026-1673](https://patchblox.com/security/data/fix/linux/alas2023-2026-1673.md) | May 11, 2026 |
| Linux | tomcat10-jsp-3.1-api amzn 2023 | 1:10.1.54-1.amzn2023.0.1 | [ALAS2023-2026-1673](https://patchblox.com/security/data/fix/linux/alas2023-2026-1673.md) | May 11, 2026 |
| Linux | tomcat10-lib amzn 2023 | 1:10.1.54-1.amzn2023.0.1 | [ALAS2023-2026-1673](https://patchblox.com/security/data/fix/linux/alas2023-2026-1673.md) | May 11, 2026 |
| Linux | tomcat10-servlet-6.0-api amzn 2023 | 1:10.1.54-1.amzn2023.0.1 | [ALAS2023-2026-1673](https://patchblox.com/security/data/fix/linux/alas2023-2026-1673.md) | May 11, 2026 |
| Linux | tomcat10-webapps amzn 2023 | 1:10.1.54-1.amzn2023.0.1 | [ALAS2023-2026-1673](https://patchblox.com/security/data/fix/linux/alas2023-2026-1673.md) | May 11, 2026 |
| Linux | tomcat11 Debian 13.5 (trixie) | 11.0.22-1~deb13u1 | [DEBIAN-CVE-2026-29146](https://patchblox.com/security/data/fix/linux/debian-cve-2026-29146.md) | Apr 9, 2026 |
| Linux | tomcat11 Debian 14 | 11.0.21-1 | [DEBIAN-CVE-2026-29146](https://patchblox.com/security/data/fix/linux/debian-cve-2026-29146.md) | Apr 9, 2026 |
| Linux | tomcat11 opensuse-leap 16.0 | 11.0.21-160000.1.1 | [OPENSUSE-SU-2026:20595-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20595-1.md) | Apr 21, 2026 |
| Linux | tomcat11 sles 15.6 | 11.0.21-150600.13.18.1 | [SUSE-SU-2026:1558-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1558-1.md) | Apr 22, 2026 |
| Linux | tomcat11 sles 15.7 | 11.0.21-150600.13.18.1 | [SUSE-SU-2026:1558-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1558-1.md) | Apr 22, 2026 |
| Linux | tomcat9 Debian 12.15 (bookworm) | 9.0.70-2 | [DEBIAN-CVE-2026-29146](https://patchblox.com/security/data/fix/linux/debian-cve-2026-29146.md) | Apr 9, 2026 |
| Linux | tomcat9 Debian 13.5 (trixie) | 9.0.70-2 | [DEBIAN-CVE-2026-29146](https://patchblox.com/security/data/fix/linux/debian-cve-2026-29146.md) | Apr 9, 2026 |
| Linux | tomcat9 Debian 14 | 9.0.70-2 | [DEBIAN-CVE-2026-29146](https://patchblox.com/security/data/fix/linux/debian-cve-2026-29146.md) | Apr 9, 2026 |
| Linux | tomcat9 RHEL 10 | 9.0.87-6.el10_0 | [RHSA-2026:36789](https://patchblox.com/security/data/fix/linux/rhsa-2026-36789.md) | Apr 9, 2026 |
| Linux | tomcat9 almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9 amzn 2023 | 1:9.0.117-1.amzn2023.0.1 | [ALAS2023-2026-1672](https://patchblox.com/security/data/fix/linux/alas2023-2026-1672.md) | May 11, 2026 |
| Linux | tomcat9 ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9 rocky 10 | 1:9.0.117-2.el10_2 | [RLSA-2026:36790](https://patchblox.com/security/data/fix/linux/rlsa-2026-36790.md) | Jul 10, 2026 |
| Linux | tomcat9-admin-webapps almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-admin-webapps amzn 2023 | 1:9.0.117-1.amzn2023.0.1 | [ALAS2023-2026-1672](https://patchblox.com/security/data/fix/linux/alas2023-2026-1672.md) | May 11, 2026 |
| Linux | tomcat9-admin-webapps ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9-docs-webapp almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-docs-webapp amzn 2023 | 1:9.0.117-1.amzn2023.0.1 | [ALAS2023-2026-1672](https://patchblox.com/security/data/fix/linux/alas2023-2026-1672.md) | May 11, 2026 |
| Linux | tomcat9-docs-webapp ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9-el-3.0-api almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-el-3.0-api amzn 2023 | 1:9.0.117-1.amzn2023.0.1 | [ALAS2023-2026-1672](https://patchblox.com/security/data/fix/linux/alas2023-2026-1672.md) | May 11, 2026 |
| Linux | tomcat9-el-3.0-api ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9-jsp-2.3-api almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-jsp-2.3-api amzn 2023 | 1:9.0.117-1.amzn2023.0.1 | [ALAS2023-2026-1672](https://patchblox.com/security/data/fix/linux/alas2023-2026-1672.md) | May 11, 2026 |
| Linux | tomcat9-jsp-2.3-api ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9-lib almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-lib amzn 2023 | 1:9.0.117-1.amzn2023.0.1 | [ALAS2023-2026-1672](https://patchblox.com/security/data/fix/linux/alas2023-2026-1672.md) | May 11, 2026 |
| Linux | tomcat9-lib ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9-servlet-4.0-api almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-servlet-4.0-api amzn 2023 | 1:9.0.117-1.amzn2023.0.1 | [ALAS2023-2026-1672](https://patchblox.com/security/data/fix/linux/alas2023-2026-1672.md) | May 11, 2026 |
| Linux | tomcat9-servlet-4.0-api ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |
| Linux | tomcat9-webapps almalinux 10 | 1:9.0.117-2.el10_2.alma.1 | [ALSA-2026:36790](https://patchblox.com/security/data/fix/linux/alsa-2026-36790.md) | Jul 8, 2026 |
| Linux | tomcat9-webapps amzn 2023 | 1:9.0.117-1.amzn2023.0.1 | [ALAS2023-2026-1672](https://patchblox.com/security/data/fix/linux/alas2023-2026-1672.md) | May 11, 2026 |
| Linux | tomcat9-webapps ol 10 | 1:9.0.117-2.el10_2 | [ELSA-2026-36790](https://patchblox.com/security/data/fix/linux/elsa-2026-36790.md) | Jul 16, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.