Linux · Security advisory · September 21, 2026
ALSA-2026:69259: Security update for 8 packages
ALSA-2026:69259, released September 21, 2026, fixes 8 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
8
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0171
77th percentile
Priority of the 8 CVEs
Patch now 0
Urgent 0
High 7
Routine 1
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| tomcat | almalinux 10 | 1:10.1.49-4.el10_2.alma.1 |
| tomcat-admin-webapps | almalinux 10 | 1:10.1.49-4.el10_2.alma.1 |
| tomcat-docs-webapp | almalinux 10 | 1:10.1.49-4.el10_2.alma.1 |
| tomcat-el-5.0-api | almalinux 10 | 1:10.1.49-4.el10_2.alma.1 |
| tomcat-jsp-3.1-api | almalinux 10 | 1:10.1.49-4.el10_2.alma.1 |
| tomcat-lib | almalinux 10 | 1:10.1.49-4.el10_2.alma.1 |
| tomcat-servlet-6.0-api | almalinux 10 | 1:10.1.49-4.el10_2.alma.1 |
| tomcat-webapps | almalinux 10 | 1:10.1.49-4.el10_2.alma.1 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-41293 | jws6-tomcat: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11... | 9.8 | 0.0171 | None reported | |
| High | CVE-2026-43512 | jws6-tomcat: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects... | 9.8 | 0.0133 | None reported | |
| High | CVE-2026-43515 | jws6-tomcat: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in... | 9.1 | 0.0122 | None reported | |
| High | CVE-2026-41284 | jws6-tomcat: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat... | 7.5 | 0.0084 | None reported | |
| High | CVE-2026-42498 | jws6-tomcat: Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache To... | 7.3 | 0.0069 | None reported | |
| High | CVE-2026-43513 | jws6-tomcat: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomca... | 7.5 | 0.0050 | None reported | |
| High | CVE-2026-32990 | tomcat: Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affec... | 7.3 | 0.0031 | None reported | |
| Routine | CVE-2026-43514 | jws6-tomcat: Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tom... | 3.7 | 0.0035 | None reported |
Showing 1 to 8 of 8
1