Linux · Security advisory · September 21, 2026

ELSA-2026-69259: Security update for 8 packages

ELSA-2026-69259, released September 21, 2026, fixes 6 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
6
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0171
77th percentile

Priority of the 6 CVEs

Patch now 0 Urgent 0 High 6 Routine 0

Fixed package versions

ProductReleaseFixed in
tomcatol 101:10.1.49-4.el10_2
tomcat-admin-webappsol 101:10.1.49-4.el10_2
tomcat-docs-webappol 101:10.1.49-4.el10_2
tomcat-el-5.0-apiol 101:10.1.49-4.el10_2
tomcat-jsp-3.1-apiol 101:10.1.49-4.el10_2
tomcat-libol 101:10.1.49-4.el10_2
tomcat-servlet-6.0-apiol 101:10.1.49-4.el10_2
tomcat-webappsol 101:10.1.49-4.el10_2

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-41293 jws6-tomcat: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11... 9.8 0.0171 None reported
High CVE-2026-43512 jws6-tomcat: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects... 9.8 0.0133 None reported
High CVE-2026-43515 jws6-tomcat: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in... 9.1 0.0122 None reported
High CVE-2026-42498 jws6-tomcat: Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache To... 7.3 0.0069 None reported
High CVE-2026-43513 jws6-tomcat: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomca... 7.5 0.0050 None reported
High CVE-2026-32990 tomcat: Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affec... 7.3 0.0031 None reported
Showing 1 to 6 of 6 1