ALAS2023-2026-3166: Security update for 8 packages

ALAS2023-2026-3166, released November 7, 2026, fixes 12 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

3 rated Critical

Exploited

None reported

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.0068

52nd percentile

Priority of the 12 CVEs

Patch now 0
                                Urgent 3
                                High 7
                                Routine 2

Fixed package versions

Product	Release	Fixed in
tomcat9	amzn 2023	1:9.0.122-1.amzn2023.0.1
tomcat9-admin-webapps	amzn 2023	1:9.0.122-1.amzn2023.0.1
tomcat9-docs-webapp	amzn 2023	1:9.0.122-1.amzn2023.0.1
tomcat9-el-3.0-api	amzn 2023	1:9.0.122-1.amzn2023.0.1
tomcat9-jsp-2.3-api	amzn 2023	1:9.0.122-1.amzn2023.0.1
tomcat9-lib	amzn 2023	1:9.0.122-1.amzn2023.0.1
tomcat9-servlet-4.0-api	amzn 2023	1:9.0.122-1.amzn2023.0.1
tomcat9-webapps	amzn 2023	1:9.0.122-1.amzn2023.0.1

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-76183	libtcnative-1-0: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629).	9.8	0.0057	None reported
Urgent	CVE-2026-86248	libtcnative-1-0: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled	9.8	0.0050	None reported
Urgent	CVE-2026-86350	libtcnative-1-0: HTTP/2 requests can cause request header mix-ups and HTTP request smuggling (bsc#1282787).	9.1	0.0048	None reported
High	CVE-2026-77791	libtcnative-1-0: uncontrolled resource consumption when sending WebSocket close message enabled a DoS attack	7.5	0.0068	None reported
High	CVE-2026-87022	libtcnative-1-0: WebSocket message smuggling when per-message-deflate is used (bsc#1282581).	7.5	0.0054	None reported
High	CVE-2026-75973	libtcnative-1-0: improper authentication when Jakarta authentication is configured with `SimpleAuthConfigProvider`	7.3	0.0052	None reported
High	CVE-2026-78437	libtcnative-1-0: incomplete cleanup allows a malformed request to potentially cause requests from another user to fail	7.3	0.0051	None reported
High	CVE-2026-78383	libtcnative-1-0: allocation of resources without limits or throttling allows an unauthenticated AJP request to pin an	7.5	0.0050	None reported
High	CVE-2026-77762	libtcnative-1-0: stale HPACK emitter injects trailers fields into another HTTP/2 request (bsc#1282599).	8.1	0.0046	None reported
High	CVE-2026-79677	libtcnative-1-0: missing release of resource after effective lifetime and comparison using wrong factors allows for	7.5	0.0042	None reported
Routine	CVE-2026-77756	libtcnative-1-0: inconsistent interpretation of HTTP requests allows an attacker to cause one request from another user	3.7	0.0053	None reported
Routine	CVE-2026-73581	libtcnative-1-0: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore	6.5	0.0016	None reported

Also fixes CVE-2026-76183

RHSA-2026:93618
jws7-mod_cluster, jws7-tomcat, jws7-tomcat-native on RHEL 10
RHSA-2026:96228
jws6-mod_cluster, jws6-tomcat, jws6-tomcat-native on RHEL 10
ALAS2023-2026-3151
tomcat11, tomcat11-admin-webapps, tomcat11-docs-webapp and 5 more on amzn 2023
SUSE-SU-2026:4546-1
tomcat, tomcat10 on sles 15.6, sles 15.7
SUSE-SU-2026:4544-1
libtcnative-1-0, tomcat11 on sles 15.6, sles 15.7
OPENSUSE-SU-2026:21984-1
libtcnative-1-0, libtcnative-2-0, tomcat and 2 more on opensuse-leap 16.0
SUSE-SU-2026:23985-1
libtcnative-1-0, libtcnative-2-0, tomcat and 2 more on sles 16.0
ALAS2023-2026-3165
tomcat10, tomcat10-admin-webapps, tomcat10-docs-webapp and 5 more on amzn 2023

Vendor advisory

https://alas.aws.amazon.com/AL2023/ALAS-2026-3166.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/alas2023-2026-3166">ALAS2023-2026-3166 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.