[El-errata] ELSA-2026-93469 Important: Oracle Linux 9 tomcat security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-93469

http://linux.oracle.com/errata/ELSA-2026-93469.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
tomcat-9.0.121-1.el9_8.noarch.rpm
tomcat-admin-webapps-9.0.121-1.el9_8.noarch.rpm
tomcat-docs-webapp-9.0.121-1.el9_8.noarch.rpm
tomcat-el-3.0-api-9.0.121-1.el9_8.noarch.rpm
tomcat-jsp-2.3-api-9.0.121-1.el9_8.noarch.rpm
tomcat-lib-9.0.121-1.el9_8.noarch.rpm
tomcat-servlet-4.0-api-9.0.121-1.el9_8.noarch.rpm
tomcat-webapps-9.0.121-1.el9_8.noarch.rpm

aarch64:
tomcat-9.0.121-1.el9_8.noarch.rpm
tomcat-admin-webapps-9.0.121-1.el9_8.noarch.rpm
tomcat-docs-webapp-9.0.121-1.el9_8.noarch.rpm
tomcat-el-3.0-api-9.0.121-1.el9_8.noarch.rpm
tomcat-jsp-2.3-api-9.0.121-1.el9_8.noarch.rpm
tomcat-lib-9.0.121-1.el9_8.noarch.rpm
tomcat-servlet-4.0-api-9.0.121-1.el9_8.noarch.rpm
tomcat-webapps-9.0.121-1.el9_8.noarch.rpm


SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/tomcat-9.0.121-1.el9_8.src.rpm

Related CVEs:

CVE-2026-65182
CVE-2026-65637
CVE-2026-65905
CVE-2026-65927
CVE-2026-68525
CVE-2026-68569
CVE-2026-68763




Description of changes:

[1:9.0.121-1]
- Resolves: RHEL-255800
  tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
- Resolves:
  tomcat: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183)
- Resolves: RHEL-271827
  tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637)
- Resolves: RHEL-271903
  tomcat: Limited replay attack possible with DIGEST authentication (CVE-2026-65905)
- Resolves: RHEL-271776
  tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)
- Resolves:
  tomcat: DoS in WebSocket chat example (CVE-2026-66299)
- Resolves:
  tomcat: Servlet role references can bypass declarative role constraints (CVE-2026-66422)
- Resolves: RHEL-271800
  tomcat: Unauthorized resource access via FORM authentication bypass(CVE-2026-68525)
- Resolves: RHEL-271810
  tomcat: Principal lookup could fail open in some cases (CVE-2026-68569)
- Resolves: RHEL-271732
  tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)
- Resolves:
  tomcat: Default to Moderate (Impact missing upstream) (CVE-2026-73180)