ALAS2023-2026-3151: Security update for 8 packages

ALAS2023-2026-3151, released November 7, 2026, fixes 22 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

7 rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.0076

55th percentile

Priority of the 22 CVEs

Patch now 0
                                Urgent 7
                                High 12
                                Routine 3

Fixed package versions

Product	Release	Fixed in
tomcat11	amzn 2023	1:11.0.26-1.amzn2023.0.1
tomcat11-admin-webapps	amzn 2023	1:11.0.26-1.amzn2023.0.1
tomcat11-docs-webapp	amzn 2023	1:11.0.26-1.amzn2023.0.1
tomcat11-el-6.0-api	amzn 2023	1:11.0.26-1.amzn2023.0.1
tomcat11-jsp-4.0-api	amzn 2023	1:11.0.26-1.amzn2023.0.1
tomcat11-lib	amzn 2023	1:11.0.26-1.amzn2023.0.1
tomcat11-servlet-6.1-api	amzn 2023	1:11.0.26-1.amzn2023.0.1
tomcat11-webapps	amzn 2023	1:11.0.26-1.amzn2023.0.1

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-65905	tomcat: Apache Tomcat: Limited replay attack possible with DIGEST authentication (bsc#1276896).	9.8	0.0076	None reported
Urgent	CVE-2026-65637	tomcat: Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - fix incomplete (bsc#1276895).	9.8	0.0075	None reported
Urgent	CVE-2026-65182	tomcat: Apache Tomcat: Bypass longest prefix security constraint (bsc#1276893).	9.1	0.0065	None reported
Urgent	CVE-2026-68525	tomcat: Apache Tomcat: Redirect after FORM auth may bypass method specific constraints (bsc#1276899).	9.1	0.0064	None reported
Urgent	CVE-2026-76183	libtcnative-1-0: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629).	9.8	0.0057	None reported
Urgent	CVE-2026-86248	libtcnative-1-0: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled	9.8	0.0050	None reported
Urgent	CVE-2026-86350	libtcnative-1-0: HTTP/2 requests can cause request header mix-ups and HTTP request smuggling (bsc#1282787).	9.1	0.0048	None reported
High	CVE-2026-68763	tomcat: Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset	8.2	0.0075	None reported
High	CVE-2026-65927	tomcat: Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control	8.2	0.0068	None reported
High	CVE-2026-77791	libtcnative-1-0: uncontrolled resource consumption when sending WebSocket close message enabled a DoS attack	7.5	0.0068	None reported
High	CVE-2026-87022	libtcnative-1-0: WebSocket message smuggling when per-message-deflate is used (bsc#1282581).	7.5	0.0054	None reported
High	CVE-2026-75973	libtcnative-1-0: improper authentication when Jakarta authentication is configured with `SimpleAuthConfigProvider`	7.3	0.0052	None reported
High	CVE-2026-78437	libtcnative-1-0: incomplete cleanup allows a malformed request to potentially cause requests from another user to fail	7.3	0.0051	None reported
High	CVE-2026-78383	libtcnative-1-0: allocation of resources without limits or throttling allows an unauthenticated AJP request to pin an	7.5	0.0050	None reported
High	CVE-2026-77762	libtcnative-1-0: stale HPACK emitter injects trailers fields into another HTTP/2 request (bsc#1282599).	8.1	0.0046	None reported
High	CVE-2026-68569	tomcat: Apache Tomcat: Principal lookup can fail open in some cases (bsc#1276900).	8.2	0.0046	None reported
High	CVE-2026-66422	tomcat: Apache Tomcat: Servlet role references can bypass declarative role constraints (bsc#1276898).	8.1	0.0043	None reported
High	CVE-2026-79677	libtcnative-1-0: missing release of resource after effective lifetime and comparison using wrong factors allows for	7.5	0.0042	None reported
High	CVE-2026-65183	tomcat: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets (bsc#1276894).	8.1	0.0040	None reported
Routine	CVE-2026-77756	libtcnative-1-0: inconsistent interpretation of HTTP requests allows an attacker to cause one request from another user	3.7	0.0053	None reported
Routine	CVE-2026-73180	tomcat: Apache Tomcat: Authenticated WebSocket session survives end of HTTP session (bsc#1276902).	6.8	0.0044	None reported
Routine	CVE-2026-73581	libtcnative-1-0: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore	6.5	0.0016	None reported

Also fixes CVE-2026-65905

RHSA-2026:73981
jws6-tomcat on RHEL 10
OPENSUSE-SU-2026:21823-1
tomcat on opensuse-leap 16.0
SUSE-SU-2026:23720-1
tomcat on sles 16.0
SUSE-SU-2026:23710-1
tomcat11 on sles 16.0
SUSE-SU-2026:23711-1
tomcat10 on sles 16.0
OPENSUSE-SU-2026:21810-1
tomcat10 on opensuse-leap 16.0
OPENSUSE-SU-2026:21811-1
tomcat11 on opensuse-leap 16.0
SUSE-SU-2026:4203-1
tomcat on sles 15.6, sles 15.7

Vendor advisory

https://alas.aws.amazon.com/AL2023/ALAS-2026-3151.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/alas2023-2026-3151">ALAS2023-2026-3151 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.