[El-errata] ELSA-2026-92862 Important: Oracle Linux 10 tomcat security, bug fix, and enhancement update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-92862

http://linux.oracle.com/errata/ELSA-2026-92862.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
tomcat-10.1.49-5.el10_2.noarch.rpm
tomcat-admin-webapps-10.1.49-5.el10_2.noarch.rpm
tomcat-docs-webapp-10.1.49-5.el10_2.noarch.rpm
tomcat-el-5.0-api-10.1.49-5.el10_2.noarch.rpm
tomcat-jsp-3.1-api-10.1.49-5.el10_2.noarch.rpm
tomcat-lib-10.1.49-5.el10_2.noarch.rpm
tomcat-servlet-6.0-api-10.1.49-5.el10_2.noarch.rpm
tomcat-webapps-10.1.49-5.el10_2.noarch.rpm

aarch64:
tomcat-10.1.49-5.el10_2.noarch.rpm
tomcat-admin-webapps-10.1.49-5.el10_2.noarch.rpm
tomcat-docs-webapp-10.1.49-5.el10_2.noarch.rpm
tomcat-el-5.0-api-10.1.49-5.el10_2.noarch.rpm
tomcat-jsp-3.1-api-10.1.49-5.el10_2.noarch.rpm
tomcat-lib-10.1.49-5.el10_2.noarch.rpm
tomcat-servlet-6.0-api-10.1.49-5.el10_2.noarch.rpm
tomcat-webapps-10.1.49-5.el10_2.noarch.rpm


SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/tomcat-10.1.49-5.el10_2.src.rpm

Related CVEs:

CVE-2026-65182
CVE-2026-65905
CVE-2026-65927
CVE-2026-68525
CVE-2026-68569
CVE-2026-68763




Description of changes:

[1:10.1.49-5]
- Resolves: RHEL-264918
  tomcat: Stalled TLS handshake when the server's first flight is too large
- Resolves: RHEL-255786
  tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
- Resolves: RHEL-271888
  tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905)
- Resolves: RHEL-271766
  tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)
- Resolves: RHEL-271791
  tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)
- Resolves: RHEL-271741
  tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)
- Resolves: RHEL-271720
  tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)