Linux · Security advisory · November 7, 2026

ELSA-2026-92862: Security update for 8 packages

ELSA-2026-92862, released November 7, 2026, fixes 6 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
6
2 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0076
55th percentile

Priority of the 6 CVEs

Patch now 0 Urgent 2 High 4 Routine 0

Fixed package versions

ProductReleaseFixed in
tomcatol 101:10.1.49-5.el10_2
tomcat-admin-webappsol 101:10.1.49-5.el10_2
tomcat-docs-webappol 101:10.1.49-5.el10_2
tomcat-el-5.0-apiol 101:10.1.49-5.el10_2
tomcat-jsp-3.1-apiol 101:10.1.49-5.el10_2
tomcat-libol 101:10.1.49-5.el10_2
tomcat-servlet-6.0-apiol 101:10.1.49-5.el10_2
tomcat-webappsol 101:10.1.49-5.el10_2

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2026-65905 tomcat9: Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator 9.8 0.0076 None reported
Urgent CVE-2026-65182 tomcat9: Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass i... 9.1 0.0065 None reported
High CVE-2026-68763 tomcat9: Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog trackin... 8.2 0.0075 None reported
High CVE-2026-65927 tomcat9: Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processin... 8.2 0.0068 None reported
High CVE-2026-68525 tomcat: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es):... 9.1 0.0064 None reported
High CVE-2026-68569 tomcat9: Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g 8.2 0.0046 None reported
Showing 1 to 6 of 6 1