[Git][security-tracker-team/security-tracker][master] Add new batch of tomcat10 issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9ebf8685 by Salvatore Bonaccorso at 2026-10-20T22:09:46+02:00
Add new batch of tomcat10 issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -34,7 +34,9 @@ CVE-2026-93475 (The X.509 parser in NetX Secure accepts an RSA public key of any
 	NOT-FOR-US: Eclipse
 CVE-2026-93446 (Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3  ...)
 	- tomcat11 <unfixed>
+	- tomcat10 <unfixed>
 	NOTE: https://github.com/apache/tomcat/commit/e49e0c47ea925ad9442ba933a144ea62433d6a06 (11.0.27)
+	NOTE: https://github.com/apache/tomcat/commit/ccbe01a52a9b255ad98e71b5bed76ed10a099503 (10.1.61)
 CVE-2026-93003 (The Web add-on's HTTP server searches the entire request packet for he ...)
 	NOT-FOR-US: Eclipse
 CVE-2026-92853 (The TLS 1.3 Certificate-message parser in NetX Secure decrements the m ...)
@@ -71,7 +73,9 @@ CVE-2026-90797 (An unlimited gzip decompression routine in chttpd in Apache Couc
 	TODO: check
 CVE-2026-88041 (Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer i ...)
 	- tomcat11 <unfixed>
+	- tomcat10 <unfixed>
 	NOTE: https://github.com/apache/tomcat/commit/a276dea827437090498678e09df0539ec397a7b5 (11.0.27)
+	NOTE: https://github.com/apache/tomcat/commit/395bcafcfcf2e1cff451a5785361679931b49a79 (10.1.61)
 CVE-2026-86471 (An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and ...)
 	TODO: check
 CVE-2026-85267 (A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to ...)
@@ -86,10 +90,14 @@ CVE-2026-75747
 	REJECTED
 CVE-2026-74049 (Execution After Redirect (EAR) vulnerability in Apache Tomcat.    This ...)
 	- tomcat11 <unfixed>
+	- tomcat10 <unfixed>
 	NOTE: https://github.com/apache/tomcat/commit/d7948a090ad3f803d9669c8b8401c39e2f532bb7 (11.0.27)
+	NOTE: https://github.com/apache/tomcat/commit/f8023d833675f00968b89b45639210d3c7dcc95d (10.1.61)
 CVE-2026-74048 (Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat.  ...)
 	- tomcat11 <unfixed>
+	- tomcat10 <unfixed>
 	NOTE: https://github.com/apache/tomcat/commit/db6d674b40ac572f3b2205a4c4f06836516fd3f5 (11.0.27)
+	NOTE: https://github.com/apache/tomcat/commit/5561032ca9d2bf32fafd8a8a417692c9826e30fe (10.1.61)
 CVE-2026-48279
 	REJECTED
 CVE-2026-43858 (A stack-based buffer overflow vulnerability could allow a remote authe ...)
@@ -553,10 +561,14 @@ CVE-2026-103119 (Buffer under-read vulnerability in Apache Tomcat meant that a l
 	NOTE: https://github.com/apache/tomcat/commit/f13748baa17a5e28925be455e0e2832e2032f58c (11.0.27)
 CVE-2026-101356 (Incorrect object recycling and re-use vulnerability in Apache Tomcat a ...)
 	- tomcat11 <unfixed>
+	- tomcat10 <unfixed>
 	NOTE: https://github.com/apache/tomcat/commit/1dc6aa151b3b99b32ac9ae7c60e41c326063321b (11.0.27)
+	NOTE: https://github.com/apache/tomcat/commit/6c7da60893bd186d6cb2df7330299d7e70e68279 (10.1.61)
 CVE-2026-101296 (A missing critical step in authentication vulnerability in Apache Tomc ...)
 	- tomcat11 <unfixed>
+	- tomcat10 <unfixed>
 	NOTE: https://github.com/apache/tomcat/commit/e43453fc04abb44f64faf571ca98af71aa3c20a1 (11.0.27)
+	NOTE: https://github.com/apache/tomcat/commit/8fafc6f263311b7a0b7ce67477822175d1adf7ce (10.1.61)
 CVE-2026-101201 (A malformed header in the binary file fed to QBinaryJson::fromBinaryDa ...)
 	TODO: check
 CVE-2026-100134 (Acrobat for Edge is affected by an out-of-bounds write vulnerability t ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ebf868559ea02165374bb82212186a7bc0da03e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ebf868559ea02165374bb82212186a7bc0da03e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261020/b8763c44/attachment.htm>