[El-errata] ELSA-2026-92869 Important: Oracle Linux 8 tomcat security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-92869

http://linux.oracle.com/errata/ELSA-2026-92869.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
tomcat-9.0.121-1.el8_10.noarch.rpm
tomcat-admin-webapps-9.0.121-1.el8_10.noarch.rpm
tomcat-docs-webapp-9.0.121-1.el8_10.noarch.rpm
tomcat-el-3.0-api-9.0.121-1.el8_10.noarch.rpm
tomcat-jsp-2.3-api-9.0.121-1.el8_10.noarch.rpm
tomcat-lib-9.0.121-1.el8_10.noarch.rpm
tomcat-servlet-4.0-api-9.0.121-1.el8_10.noarch.rpm
tomcat-webapps-9.0.121-1.el8_10.noarch.rpm

aarch64:
tomcat-9.0.121-1.el8_10.noarch.rpm
tomcat-admin-webapps-9.0.121-1.el8_10.noarch.rpm
tomcat-docs-webapp-9.0.121-1.el8_10.noarch.rpm
tomcat-el-3.0-api-9.0.121-1.el8_10.noarch.rpm
tomcat-jsp-2.3-api-9.0.121-1.el8_10.noarch.rpm
tomcat-lib-9.0.121-1.el8_10.noarch.rpm
tomcat-servlet-4.0-api-9.0.121-1.el8_10.noarch.rpm
tomcat-webapps-9.0.121-1.el8_10.noarch.rpm


SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/tomcat-9.0.121-1.el8_10.src.rpm

Related CVEs:

CVE-2026-65182
CVE-2026-65637
CVE-2026-65905
CVE-2026-65927
CVE-2026-68525
CVE-2026-68569




Description of changes:

[1:9.0.121-1]
- Resolves: RHEL-255793
  tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
- Resolves:
  Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183)
- Resolves: RHEL-271822
  tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637)
- Resolves: RHEL-271900
  tomcat: Limited replay attack possible with DIGEST authentication (CVE-2026-65905)
- Resolves: RHEL-271775
  tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)
- Resolves:
  DoS in WebSocket chat example (CVE-2026-66299)
- Resolves:
  Servlet role references can bypass declarative role constraints (CVE-2026-66422)
- Resolves: RHEL-271798
  tomcat: Unauthorized resource access via FORM authentication bypass(CVE-2026-68525)
- Resolves: RHEL-271749
  tomcat: Principal lookup could fail open in some cases (CVE-2026-68569)
- Resolves:
  Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)
- Resolves:
  Default to Moderate (Impact missing upstream) (CVE-2026-73180)