# ALSA-2026:68677: Security update for 8 packages

ALSA-2026:68677, released September 17, 2026, fixes 29 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alsa-2026-68677
- Platform: Linux
- Released: Sep 17, 2026
- Priority: Urgent (Closes CVE-2026-59084, rated Critical)
- CVEs: 29, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:68677

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [tomcat](https://patchblox.com/security/data/product/linux/tomcat.md) | almalinux 8 | 1:9.0.120-1.el8_10 |
| [tomcat-admin-webapps](https://patchblox.com/security/data/product/linux/tomcat-admin-webapps.md) | almalinux 8 | 1:9.0.120-1.el8_10 |
| [tomcat-docs-webapp](https://patchblox.com/security/data/product/linux/tomcat-docs-webapp.md) | almalinux 8 | 1:9.0.120-1.el8_10 |
| [tomcat-el-3.0-api](https://patchblox.com/security/data/product/linux/tomcat-el-3.0-api.md) | almalinux 8 | 1:9.0.120-1.el8_10 |
| [tomcat-jsp-2.3-api](https://patchblox.com/security/data/product/linux/tomcat-jsp-2.3-api.md) | almalinux 8 | 1:9.0.120-1.el8_10 |
| [tomcat-lib](https://patchblox.com/security/data/product/linux/tomcat-lib.md) | almalinux 8 | 1:9.0.120-1.el8_10 |
| [tomcat-servlet-4.0-api](https://patchblox.com/security/data/product/linux/tomcat-servlet-4.0-api.md) | almalinux 8 | 1:9.0.120-1.el8_10 |
| [tomcat-webapps](https://patchblox.com/security/data/product/linux/tomcat-webapps.md) | almalinux 8 | 1:9.0.120-1.el8_10 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-59084](https://patchblox.com/security/data/cve/CVE-2026-59084.md) | Urgent | tomcat11: Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the... | 9.1 | 0.0051 |  |
| [CVE-2025-55754](https://patchblox.com/security/data/cve/CVE-2025-55754.md) | High | jws6-tomcat: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape A... | 9.6 | 0.1034 |  |
| [CVE-2024-52316](https://patchblox.com/security/data/cve/CVE-2024-52316.md) | High | tomcat: Unchecked Error Condition vulnerability in Apache Tomcat | 9.8 | 0.0625 |  |
| [CVE-2025-46701](https://patchblox.com/security/data/cve/CVE-2025-46701.md) | High | libtomcat10-embed-java: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCIservlet allows security constraint bypass o... | 7.3 | 0.0314 |  |
| [CVE-2026-55957](https://patchblox.com/security/data/cve/CVE-2026-55957.md) | High | tomcat: Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authentic... | 7.3 | 0.0286 |  |
| [CVE-2024-54677](https://patchblox.com/security/data/cve/CVE-2024-54677.md) | High | tomcat: Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to... | 8.6 | 0.0194 |  |
| [CVE-2026-41293](https://patchblox.com/security/data/cve/CVE-2026-41293.md) | High | jws6-tomcat: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11... | 9.8 | 0.0171 |  |
| [CVE-2026-43512](https://patchblox.com/security/data/cve/CVE-2026-43512.md) | High | jws6-tomcat: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects... | 9.8 | 0.0133 |  |
| [CVE-2025-61795](https://patchblox.com/security/data/cve/CVE-2025-61795.md) | High | jws6-tomcat: Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limit... | 7.5 | 0.0125 |  |
| [CVE-2026-43515](https://patchblox.com/security/data/cve/CVE-2026-43515.md) | High | jws6-tomcat: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in... | 9.1 | 0.0122 |  |
| [CVE-2026-41284](https://patchblox.com/security/data/cve/CVE-2026-41284.md) | High | jws6-tomcat: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat... | 7.5 | 0.0084 |  |
| [CVE-2026-29145](https://patchblox.com/security/data/cve/CVE-2026-29145.md) | High | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  Security Fix(es):... | 9.1 | 0.0073 |  |
| [CVE-2026-24880](https://patchblox.com/security/data/cve/CVE-2026-24880.md) | High | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  Security Fix(es):... | 7.5 | 0.0071 |  |
| [CVE-2026-53404](https://patchblox.com/security/data/cve/CVE-2026-53404.md) | High | jws6-tomcat: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first c... | 7.3 | 0.0070 |  |
| [CVE-2026-42498](https://patchblox.com/security/data/cve/CVE-2026-42498.md) | High | jws6-tomcat: Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache To... | 7.3 | 0.0069 |  |
| [CVE-2026-55276](https://patchblox.com/security/data/cve/CVE-2026-55276.md) | High | jws7-tomcat: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty author... | 9.1 | 0.0061 |  |
| [CVE-2026-53434](https://patchblox.com/security/data/cve/CVE-2026-53434.md) | High | jws7-tomcat: Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based conn... | 9.1 | 0.0059 |  |
| [CVE-2026-25854](https://patchblox.com/security/data/cve/CVE-2026-25854.md) | High | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  Security Fix(es):... | 7.4 | 0.0058 |  |
| [CVE-2026-24733](https://patchblox.com/security/data/cve/CVE-2026-24733.md) | High | tomcat9: Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method | 7.4 | 0.0055 |  |
| [CVE-2026-59083](https://patchblox.com/security/data/cve/CVE-2026-59083.md) | High | jws7-tomcat: Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security cons... | 9.1 | 0.0052 |  |
| [CVE-2026-43513](https://patchblox.com/security/data/cve/CVE-2026-43513.md) | High | jws6-tomcat: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomca... | 7.5 | 0.0050 |  |
| [CVE-2026-34483](https://patchblox.com/security/data/cve/CVE-2026-34483.md) | High | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  Security Fix(es):... | 7.5 | 0.0047 |  |
| [CVE-2026-34487](https://patchblox.com/security/data/cve/CVE-2026-34487.md) | High | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  Security Fix(es):... | 7.5 | 0.0046 |  |
| [CVE-2025-66614](https://patchblox.com/security/data/cve/CVE-2025-66614.md) | High | tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  Security Fix(es):... | 9.1 | 0.0027 |  |
| [CVE-2026-50229](https://patchblox.com/security/data/cve/CVE-2026-50229.md) | Routine | tomcat11: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess examp... | 6.1 | 0.0409 |  |
| [CVE-2025-55668](https://patchblox.com/security/data/cve/CVE-2025-55668.md) | Routine | jws6-tomcat: Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 t... | 6.5 | 0.0095 |  |
| [CVE-2026-55956](https://patchblox.com/security/data/cve/CVE-2026-55956.md) | Routine | jws6-tomcat: Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet... | 6.5 | 0.0070 |  |
| [CVE-2026-55955](https://patchblox.com/security/data/cve/CVE-2026-55955.md) | Routine | tomcat11: Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in t... | 6.5 | 0.0044 |  |
| [CVE-2026-43514](https://patchblox.com/security/data/cve/CVE-2026-43514.md) | Routine | jws6-tomcat: Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tom... | 3.7 | 0.0035 |  |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo