Linux · 
openSUSE Leap · Security advisory · September 30, 2026
openSUSE Leap · Security advisory · September 30, 2026OPENSUSE-SU-2026:21984-1: Security update for 5 packages
OPENSUSE-SU-2026:21984-1, released September 30, 2026, fixes 15 CVEs across 5 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
15
4 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0068
52nd percentile
Priority of the 15 CVEs
Patch now 0
Urgent 4
High 9
Routine 2
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| libtcnative-1-0 | opensuse-leap 16.0 | 1.3.9-160000.1.1 |
| libtcnative-2-0 | opensuse-leap 16.0 | 2.0.16-160000.1.1 |
| tomcat | opensuse-leap 16.0 | 9.0.122-160000.1.1 |
| tomcat10 | opensuse-leap 16.0 | 10.1.60-160000.1.1 |
| tomcat11 | opensuse-leap 16.0 | 11.0.26-160000.1.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-76183 | libtcnative-1-0: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629). | 9.8 | 0.0057 | None reported |
| Urgent | CVE-2026-86248 | libtcnative-1-0: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled | 9.8 | 0.0050 | None reported |
| Urgent | CVE-2026-86350 | libtcnative-1-0: HTTP/2 requests can cause request header mix-ups and HTTP request smuggling (bsc#1282787). | 9.1 | 0.0048 | None reported |
| Urgent | CVE-2026-86246 | libtcnative-1-0: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and | 9.1 | 0.0035 | None reported |
| High | CVE-2026-77791 | libtcnative-1-0: uncontrolled resource consumption when sending WebSocket close message enabled a DoS attack | 7.5 | 0.0068 | None reported |
| High | CVE-2026-86243 | libtcnative-1-0: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash | 7.5 | 0.0056 | None reported |
| High | CVE-2026-87022 | libtcnative-1-0: WebSocket message smuggling when per-message-deflate is used (bsc#1282581). | 7.5 | 0.0054 | None reported |
| High | CVE-2026-75973 | libtcnative-1-0: improper authentication when Jakarta authentication is configured with `SimpleAuthConfigProvider` | 7.3 | 0.0052 | None reported |
| High | CVE-2026-78437 | libtcnative-1-0: incomplete cleanup allows a malformed request to potentially cause requests from another user to fail | 7.3 | 0.0051 | None reported |
| High | CVE-2026-78383 | libtcnative-1-0: allocation of resources without limits or throttling allows an unauthenticated AJP request to pin an | 7.5 | 0.0050 | None reported |
| High | CVE-2026-77762 | libtcnative-1-0: stale HPACK emitter injects trailers fields into another HTTP/2 request (bsc#1282599). | 8.1 | 0.0046 | None reported |
| High | CVE-2026-79677 | libtcnative-1-0: missing release of resource after effective lifetime and comparison using wrong factors allows for | 7.5 | 0.0042 | None reported |
| High | CVE-2026-86247 | libtcnative-1-0: race condition allows client certificate verification requirements to be down-graded for some | 7.4 | 0.0020 | None reported |
| Routine | CVE-2026-77756 | libtcnative-1-0: inconsistent interpretation of HTTP requests allows an attacker to cause one request from another user | 3.7 | 0.0053 | None reported |
| Routine | CVE-2026-73581 | libtcnative-1-0: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore | 6.5 | 0.0016 | None reported |
Showing 1 to 15 of 15
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.