Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache Tomcat embedded packages may let attackers run code
published 3 months ago
Summary
Several Apache Tomcat embedded libraries—including core, EL, Jasper, WebSocket, and programmatic modules—contain a security weakness that could allow an attacker to execute code on the server. This could compromise the confidentiality and integrity of your applications. Update to the TuxCare‑provided version 10.1.18‑tuxcare.4 to resolve the issue.
What to do
- Update apache org.apache.tomcat.embed:tomcat-embed-core to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat.embed:tomcat-embed-el to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat.embed:tomcat-embed-jasper to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat.embed:tomcat-embed-websocket to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat.experimental:tomcat-embed-programmatic to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-annotations-api to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-api to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-catalina to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-catalina-ant to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-catalina-ha to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-coyote to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-dbcp to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-el-api to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-i18n-cs to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-i18n-de to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-i18n-es to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-i18n-fr to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-i18n-ja to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-i18n-ko to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-i18n-pt-br to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-i18n-ru to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-i18n-zh-cn to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-jasper to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-jasper-el to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-jaspic-api to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-jdbc to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-jni to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-jsp-api to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-juli to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-servlet-api to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-ssi to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-storeconfig to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-tribes to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-util to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-util-scan to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-websocket to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-websocket-api to version 10.1.18-tuxcare.4.
- Update apache org.apache.tomcat:tomcat-websocket-client-api to version 10.1.18-tuxcare.4.
- Update org.apache.tomcat:tomcat to version 10.1.18-tuxcare.4.
- Update org.apache.tomcat:tomcat-catalina-ha to version 10.1.18-tuxcare.4.
- Update org.apache.tomcat:tomcat-storeconfig to version 10.1.18-tuxcare.4.
- Update org.apache.tomcat:tomcat-tribes to version 10.1.18-tuxcare.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | apache | org.apache.tomcat.embed:tomcat-embed-core |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat.embed:tomcat-embed-el |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat.embed:tomcat-embed-jasper |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat.embed:tomcat-embed-websocket |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat.experimental:tomcat-embed-programmatic |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-annotations-api |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-api |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-catalina |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-catalina-ant |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-catalina-ha |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-coyote |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-dbcp |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-el-api |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-i18n-cs |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-i18n-de |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-i18n-es |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-i18n-fr |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-i18n-ja |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-i18n-ko |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-i18n-pt-br |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-i18n-ru |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-i18n-zh-cn |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-jasper |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-jasper-el |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-jaspic-api |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-jdbc |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-jni |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-jsp-api |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-juli |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-servlet-api |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-ssi |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-storeconfig |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-tribes |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-util |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-util-scan |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-websocket |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-websocket-api |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.tomcat:tomcat-websocket-client-api |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | – | org.apache.tomcat:tomcat |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | – | org.apache.tomcat:tomcat-catalina-ha |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | – | org.apache.tomcat:tomcat-storeconfig |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
| TuxCare:Maven | – | org.apache.tomcat:tomcat-tribes |
>= 10.1.18, < 10.1.18-tuxcare.4 Fix: upgrade to 10.1.18-tuxcare.4
|
Original advisory text
TuxCare security update for org.apache.tomcat (1 CVE)
TuxCare rebuilt 2 org.apache.tomcat packages to address 1 CVE. Fixed in 10.1.18-tuxcare.4.
Timeline
Published4 Aug 2026
Updated2 Nov 2026
First seen15 Oct 2026
Sources
CLSA-2026-1776818221 · OSV
Track software like this
Free during beta