{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ntomcat11:\n  * tomcat11-11.0.21-0.1.hum1 (noarch)\n  * tomcat11-admin-webapps-11.0.21-0.1.hum1 (noarch)\n  * tomcat11-docs-webapp-11.0.21-0.1.hum1 (noarch)\n  * tomcat11-el-6.0-api-11.0.21-0.1.hum1 (noarch)\n  * tomcat11-jsp-4.0-api-11.0.21-0.1.hum1 (noarch)\n  * tomcat11-lib-11.0.21-0.1.hum1 (noarch)\n  * tomcat11-servlet-6.1-api-11.0.21-0.1.hum1 (noarch)\n  * tomcat11-webapps-11.0.21-0.1.hum1 (noarch)\n  * tomcat11-11.0.21-0.1.hum1.src (source)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:6569",
        "url": "https://access.redhat.com/errata/RHSA-2026:6569"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-55668",
        "url": "https://access.redhat.com/security/cve/CVE-2025-55668"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61795",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61795"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-55754",
        "url": "https://access.redhat.com/security/cve/CVE-2025-55754"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-55752",
        "url": "https://access.redhat.com/security/cve/CVE-2025-55752"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-24733",
        "url": "https://access.redhat.com/security/cve/CVE-2026-24733"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-66614",
        "url": "https://access.redhat.com/security/cve/CVE-2025-66614"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-24734",
        "url": "https://access.redhat.com/security/cve/CVE-2026-24734"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6569.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-06-30T03:14:55+00:00",
      "generator": {
        "date": "2026-06-30T03:14:55+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.0"
        }
      },
      "id": "RHSA-2026:6569",
      "initial_release_date": "2026-04-04T16:29:57+00:00",
      "revision_history": [
        {
          "date": "2026-04-04T16:29:57+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-18T19:58:05+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-30T03:14:55+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat11-main@noarch",
                "product": {
                  "name": "tomcat11-main@noarch",
                  "product_id": "tomcat11-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat11@11.0.21-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat11-main@src",
                "product": {
                  "name": "tomcat11-main@src",
                  "product_id": "tomcat11-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat11@11.0.21-0.1.hum1?arch=source\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat11-main@noarch"
        },
        "product_reference": "tomcat11-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat11-main@src"
        },
        "product_reference": "tomcat11-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-55668",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "discovery_date": "2025-08-13T14:00:45.674371+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2388226"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will occur within the context of the attacker\u0027s session. This could allow an attacker to hijack the victim\u0027s session and perform actions on their behalf.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat11-main@noarch",
          "Red Hat Hardened Images:tomcat11-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-55668"
        },
        {
          "category": "external",
          "summary": "RHBZ#2388226",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388226"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-55668",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-55668"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-55668",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55668"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6",
          "url": "https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21",
          "url": "https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95",
          "url": "https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47",
          "url": "https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47"
        }
      ],
      "release_date": "2025-08-13T13:21:35.743000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-04T16:29:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:6569"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve"
    },
    {
      "cve": "CVE-2025-55752",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "discovery_date": "2025-10-27T18:01:22.818037+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2406591"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A directory traversal vulnerability in Apache Tomcat caused by improper URL normalization during request rewriting. When specific rewrite rules are used, an attacker could craft a malicious request to bypass access restrictions and reach protected directories such as /WEB-INF/ or /META-INF/. If HTTP PUT requests are also enabled, this flaw could allow the upload of malicious files, potentially leading to remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important rather than Critical because successful exploitation depends on specific, non-default configuration conditions. The flaw only becomes exploitable when both URL rewriting rules that modify the request path are in use and HTTP PUT requests are enabled \u2014 a feature typically restricted to administrative or trusted users. In standard Tomcat deployments, PUT is disabled or tightly controlled, and rewrite configurations rarely expose sensitive paths. Therefore, while the issue could theoretically lead to remote code execution, the limited attack surface and requirement for uncommon setup conditions significantly reduce its overall risk level.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat11-main@noarch",
          "Red Hat Hardened Images:tomcat11-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-55752"
        },
        {
          "category": "external",
          "summary": "RHBZ#2406591",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406591"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-55752",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-55752"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-55752",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55752"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/fec06c610ed7466b401e29cc567a58aee5ed826a",
          "url": "https://github.com/apache/tomcat/commit/fec06c610ed7466b401e29cc567a58aee5ed826a"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog",
          "url": "https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog"
        }
      ],
      "release_date": "2025-10-27T17:29:56.060000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-04T16:29:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:6569"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nTo reduced the risk, by disabling or strictly limiting the use of HTTP PUT requests to trusted, authenticated users only. Additionally, administrators should review and adjust URL rewrite rules to ensure they do not manipulate request paths in ways that could expose protected directories such as /WEB-INF/ or /META-INF/. Implementing strict access controls and monitoring for unexpected rewrite or upload behavior can further minimize potential exploitation.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE"
    },
    {
      "cve": "CVE-2025-55754",
      "cwe": {
        "id": "CWE-150",
        "name": "Improper Neutralization of Escape, Meta, or Control Sequences"
      },
      "discovery_date": "2025-10-27T18:01:17.953987+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2406590"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An improper input neutralization flaw has been discovered in Apache Tomcat. \nTomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat11-main@noarch",
          "Red Hat Hardened Images:tomcat11-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-55754"
        },
        {
          "category": "external",
          "summary": "RHBZ#2406590",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406590"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-55754",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-55754"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-55754",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55754"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/5a3db092982c0c58d4855304167ee757fe5e79bb",
          "url": "https://github.com/apache/tomcat/commit/5a3db092982c0c58d4855304167ee757fe5e79bb"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd",
          "url": "https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd"
        }
      ],
      "release_date": "2025-10-27T17:29:50.756000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-04T16:29:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:6569"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation"
    },
    {
      "cve": "CVE-2025-61795",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "discovery_date": "2025-10-27T18:01:06.418669+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2406588"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw has been discovered in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat11-main@noarch",
          "Red Hat Hardened Images:tomcat11-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61795"
        },
        {
          "category": "external",
          "summary": "RHBZ#2406588",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406588"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61795",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61795"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06",
          "url": "https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp",
          "url": "https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp"
        }
      ],
      "release_date": "2025-10-27T17:30:28.334000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-04T16:29:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:6569"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service"
    },
    {
      "cve": "CVE-2025-66614",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-02-17T20:04:14.943661+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2440430"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field. The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Client certificate verification bypass due to virtual host mapping",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat11-main@noarch",
          "Red Hat Hardened Images:tomcat11-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66614"
        },
        {
          "category": "external",
          "summary": "RHBZ#2440430",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440430"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66614",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66614"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66614",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66614"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7",
          "url": "https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7"
        }
      ],
      "release_date": "2026-02-17T18:48:30.577000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-04T16:29:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:6569"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Client certificate verification bypass due to virtual host mapping"
    },
    {
      "cve": "CVE-2026-24733",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2026-02-17T20:05:04.953085+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2440437"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0.9 protocol can bypass the intended denial rule, enabling an attacker to access resources that should be protected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: security constraint bypass with HTTP/0.9",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is only exploitable when Tomcat is configured to allow HEAD requests but deny GET requests to the same resource, a very unlikely configuration. Due to this reason, this flaw has been rated with a low severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat11-main@noarch",
          "Red Hat Hardened Images:tomcat11-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-24733"
        },
        {
          "category": "external",
          "summary": "RHBZ#2440437",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440437"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-24733",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24733"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24733",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24733"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f",
          "url": "https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f"
        }
      ],
      "release_date": "2026-02-17T18:50:43.871000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-04T16:29:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:6569"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, ensure that security constraints are consistent across similar methods (e.g., if GET is denied, HEAD should likely be denied) or block HTTP/0.9 traffic via a reverse proxy or firewall, if it is not required.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: security constraint bypass with HTTP/0.9"
    },
    {
      "cve": "CVE-2026-24734",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-02-17T20:03:45.051629+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2440426"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol (OCSP) responder is used, the Tomcat Native component, and Tomcat\u0027s FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability could allow an attacker to bypass certificate revocation checks, potentially leading to the acceptance of revoked certificates.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability doesn\u0027t affect the Apache Tomcat distributed with Red Hat Enterprise 8 and Red Hat Enterprise up to the version 9.7 as the vulnerable code is not built. The vulnerable code is compiled with Red Hat Enterprise Linux 9.8 and above.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat11-main@noarch",
          "Red Hat Hardened Images:tomcat11-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-24734"
        },
        {
          "category": "external",
          "summary": "RHBZ#2440426",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440426"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-24734",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24734"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24734",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24734"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml",
          "url": "https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml"
        }
      ],
      "release_date": "2026-02-17T18:53:12.228000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-04T16:29:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:6569"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat11-main@noarch",
            "Red Hat Hardened Images:tomcat11-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ntomcat10:\n  * tomcat10-10.1.54-1.hum1 (noarch)\n  * tomcat10-admin-webapps-10.1.54-1.hum1 (noarch)\n  * tomcat10-common-10.1.54-1.hum1 (noarch)\n  * tomcat10-docs-webapp-10.1.54-1.hum1 (noarch)\n  * tomcat10-el-5.0-api-10.1.54-1.hum1 (noarch)\n  * tomcat10-jsp-3.1-api-10.1.54-1.hum1 (noarch)\n  * tomcat10-lib-10.1.54-1.hum1 (noarch)\n  * tomcat10-servlet-6.0-api-10.1.54-1.hum1 (noarch)\n  * tomcat10-user-instance-10.1.54-1.hum1 (noarch)\n  * tomcat10-webapps-10.1.54-1.hum1 (noarch)\n  * tomcat10-10.1.54-1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:8334",
        "url": "https://access.redhat.com/errata/RHSA-2026:8334"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-55668",
        "url": "https://access.redhat.com/security/cve/CVE-2025-55668"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61795",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61795"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-55754",
        "url": "https://access.redhat.com/security/cve/CVE-2025-55754"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-55752",
        "url": "https://access.redhat.com/security/cve/CVE-2025-55752"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-24733",
        "url": "https://access.redhat.com/security/cve/CVE-2026-24733"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-66614",
        "url": "https://access.redhat.com/security/cve/CVE-2025-66614"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-24734",
        "url": "https://access.redhat.com/security/cve/CVE-2026-24734"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8334.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-06-30T03:15:00+00:00",
      "generator": {
        "date": "2026-06-30T03:15:00+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.0"
        }
      },
      "id": "RHSA-2026:8334",
      "initial_release_date": "2026-04-15T17:31:38+00:00",
      "revision_history": [
        {
          "date": "2026-04-15T17:31:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-18T19:58:04+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-30T03:15:00+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat10-main@noarch",
                "product": {
                  "name": "tomcat10-main@noarch",
                  "product_id": "tomcat10-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10@10.1.54-1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat10-main@src",
                "product": {
                  "name": "tomcat10-main@src",
                  "product_id": "tomcat10-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat10@10.1.54-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-main@noarch"
        },
        "product_reference": "tomcat10-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:tomcat10-main@src"
        },
        "product_reference": "tomcat10-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-55668",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "discovery_date": "2025-08-13T14:00:45.674371+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2388226"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will occur within the context of the attacker\u0027s session. This could allow an attacker to hijack the victim\u0027s session and perform actions on their behalf.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-main@noarch",
          "Red Hat Hardened Images:tomcat10-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-55668"
        },
        {
          "category": "external",
          "summary": "RHBZ#2388226",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2388226"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-55668",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-55668"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-55668",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55668"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6",
          "url": "https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21",
          "url": "https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95",
          "url": "https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47",
          "url": "https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47"
        }
      ],
      "release_date": "2025-08-13T13:21:35.743000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-15T17:31:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8334"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve"
    },
    {
      "cve": "CVE-2025-55752",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "discovery_date": "2025-10-27T18:01:22.818037+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2406591"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A directory traversal vulnerability in Apache Tomcat caused by improper URL normalization during request rewriting. When specific rewrite rules are used, an attacker could craft a malicious request to bypass access restrictions and reach protected directories such as /WEB-INF/ or /META-INF/. If HTTP PUT requests are also enabled, this flaw could allow the upload of malicious files, potentially leading to remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important rather than Critical because successful exploitation depends on specific, non-default configuration conditions. The flaw only becomes exploitable when both URL rewriting rules that modify the request path are in use and HTTP PUT requests are enabled \u2014 a feature typically restricted to administrative or trusted users. In standard Tomcat deployments, PUT is disabled or tightly controlled, and rewrite configurations rarely expose sensitive paths. Therefore, while the issue could theoretically lead to remote code execution, the limited attack surface and requirement for uncommon setup conditions significantly reduce its overall risk level.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-main@noarch",
          "Red Hat Hardened Images:tomcat10-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-55752"
        },
        {
          "category": "external",
          "summary": "RHBZ#2406591",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406591"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-55752",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-55752"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-55752",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55752"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/fec06c610ed7466b401e29cc567a58aee5ed826a",
          "url": "https://github.com/apache/tomcat/commit/fec06c610ed7466b401e29cc567a58aee5ed826a"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog",
          "url": "https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog"
        }
      ],
      "release_date": "2025-10-27T17:29:56.060000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-15T17:31:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8334"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nTo reduced the risk, by disabling or strictly limiting the use of HTTP PUT requests to trusted, authenticated users only. Additionally, administrators should review and adjust URL rewrite rules to ensure they do not manipulate request paths in ways that could expose protected directories such as /WEB-INF/ or /META-INF/. Implementing strict access controls and monitoring for unexpected rewrite or upload behavior can further minimize potential exploitation.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE"
    },
    {
      "cve": "CVE-2025-55754",
      "cwe": {
        "id": "CWE-150",
        "name": "Improper Neutralization of Escape, Meta, or Control Sequences"
      },
      "discovery_date": "2025-10-27T18:01:17.953987+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2406590"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An improper input neutralization flaw has been discovered in Apache Tomcat. \nTomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-main@noarch",
          "Red Hat Hardened Images:tomcat10-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-55754"
        },
        {
          "category": "external",
          "summary": "RHBZ#2406590",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406590"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-55754",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-55754"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-55754",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55754"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/5a3db092982c0c58d4855304167ee757fe5e79bb",
          "url": "https://github.com/apache/tomcat/commit/5a3db092982c0c58d4855304167ee757fe5e79bb"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd",
          "url": "https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd"
        }
      ],
      "release_date": "2025-10-27T17:29:50.756000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-15T17:31:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8334"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation"
    },
    {
      "cve": "CVE-2025-61795",
      "cwe": {
        "id": "CWE-404",
        "name": "Improper Resource Shutdown or Release"
      },
      "discovery_date": "2025-10-27T18:01:06.418669+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2406588"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw has been discovered in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-main@noarch",
          "Red Hat Hardened Images:tomcat10-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61795"
        },
        {
          "category": "external",
          "summary": "RHBZ#2406588",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406588"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61795",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61795"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06",
          "url": "https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp",
          "url": "https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp"
        }
      ],
      "release_date": "2025-10-27T17:30:28.334000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-15T17:31:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8334"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service"
    },
    {
      "cve": "CVE-2025-66614",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-02-17T20:04:14.943661+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2440430"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field. The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Client certificate verification bypass due to virtual host mapping",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-main@noarch",
          "Red Hat Hardened Images:tomcat10-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66614"
        },
        {
          "category": "external",
          "summary": "RHBZ#2440430",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440430"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66614",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66614"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66614",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66614"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7",
          "url": "https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7"
        }
      ],
      "release_date": "2026-02-17T18:48:30.577000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-15T17:31:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8334"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Client certificate verification bypass due to virtual host mapping"
    },
    {
      "cve": "CVE-2026-24733",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2026-02-17T20:05:04.953085+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2440437"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0.9 protocol can bypass the intended denial rule, enabling an attacker to access resources that should be protected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: security constraint bypass with HTTP/0.9",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is only exploitable when Tomcat is configured to allow HEAD requests but deny GET requests to the same resource, a very unlikely configuration. Due to this reason, this flaw has been rated with a low severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-main@noarch",
          "Red Hat Hardened Images:tomcat10-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-24733"
        },
        {
          "category": "external",
          "summary": "RHBZ#2440437",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440437"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-24733",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24733"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24733",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24733"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f",
          "url": "https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f"
        }
      ],
      "release_date": "2026-02-17T18:50:43.871000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-15T17:31:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8334"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, ensure that security constraints are consistent across similar methods (e.g., if GET is denied, HEAD should likely be denied) or block HTTP/0.9 traffic via a reverse proxy or firewall, if it is not required.",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: security constraint bypass with HTTP/0.9"
    },
    {
      "cve": "CVE-2026-24734",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-02-17T20:03:45.051629+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2440426"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol (OCSP) responder is used, the Tomcat Native component, and Tomcat\u0027s FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability could allow an attacker to bypass certificate revocation checks, potentially leading to the acceptance of revoked certificates.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability doesn\u0027t affect the Apache Tomcat distributed with Red Hat Enterprise 8 and Red Hat Enterprise up to the version 9.7 as the vulnerable code is not built. The vulnerable code is compiled with Red Hat Enterprise Linux 9.8 and above.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:tomcat10-main@noarch",
          "Red Hat Hardened Images:tomcat10-main@src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-24734"
        },
        {
          "category": "external",
          "summary": "RHBZ#2440426",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440426"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-24734",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-24734"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24734",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24734"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml",
          "url": "https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml"
        }
      ],
      "release_date": "2026-02-17T18:53:12.228000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-15T17:31:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8334"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:tomcat10-main@noarch",
            "Red Hat Hardened Images:tomcat10-main@src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for tomcat11",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for tomcat11 fixes the following issues:\n\nUpdate to Tomcat 11.0.18:\n\n- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).\n- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).\n- CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).\n\nChangelog:\n\n * Catalina\n + Fix: 69932: Fix request end access log pattern regression, which would log\n the start time of the request instead. (remm)\n + Fix: 69623: Additional fix for the long standing regression that meant\n that calls to ClassLoader.getResource().getContent() failed when made from\n within a web application with resource caching enabled if the target\n resource was packaged in a JAR file. (markt)\n + Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the\n CsrfPreventionFilter. (schultz)\n + Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2\n requests when the content-length header is not set. (dsoumis)\n + Update: Enable minimum and recommended Tomcat Native versions to be set\n separately for Tomcat Native 1.x and 2.x. Update the minimum and\n recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum\n and recommended versions for Tomcat Native 2.x to 2.0.12. (markt)\n + Add: Add a new ssoReauthenticationMode to the Tomcat provided\n Authenticators that provides a per Authenticator override of the SSO Valve\n requireReauthentication attribute. (markt)\n + Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception\n rather than silently using a replacement character. (markt)\n + Fix: 69871: Increase log level to INFO for missing configuration for the\n rewrite valve. (remm)\n + Fix: Add log warnings for additional Host appBase suspicious values.\n (remm)\n + Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.\n org.apache.catalina.Connector no longer requires\n org.apache.tomcat.jni.AprStatus to be present. (markt)\n + Add: Add the ability to use a custom function to generate the client\n identifier in the CrawlerSessionManagerValve. This is only available\n programmatically. Pull request #902 by Brian Matzon. (markt)\n + Fix: Change the SSO reauthentication behaviour for SPNEGO authentication\n so that a normal SPNEGO authentication is performed if the SSL Valve is\n configured with reauthentication enabled. This is so that the delegated\n credentials will be available to the web application. (markt)\n + Fix: When generating the class path in the Loader, re-order the check on\n individual class path components to avoid a potential\n NullPointerException. Identified by Coverity Scan. (markt)\n + Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull\n request #915 by Joshua Rogers. (remm)\n + Update: Add an attribute, digestInRfc3112Order, to\n MessageDigestCredentialHandler to control the order in which the\n credential and salt are digested. By default, the current, non-RFC 3112\n compliant, order of salt then credential will be used. This default will\n change in Tomcat 12 to the RFC 3112 compliant order of credential then\n salt. (markt)\n * Cluster\n + Add: 62814: Document that human-readable names may be used for\n mapSendOptions and align documentation with channelSendOptions. Based on\n pull request #929 by archan0621. (markt)\n * Clustering\n + Fix: Correct a regression introduced in 11.0.11 that broke some clustering\n configurations. (markt)\n * Coyote\n + Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown\n that triggered a significant memory leak. Patch provided by Wes. (markt)\n + Fix: Prevent concurrent release of OpenSSLEngine resources and the\n termination of the Tomcat Native library as it can cause crashes during\n Tomcat shutdown. (markt)\n + Fix: Improve warnings when setting ciphers lists in the FFM code,\n mirroring the tomcat-native changes. (remm)\n + Fix: 69910: Dereference TLS objects right after closing a socket to\n improve memory efficiency. (remm)\n + Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig\n to reflect the existing implementation that allows one configuration style\n to be used for the trust attributes and a different style for all the\n other attributes. (markt)\n + Fix: Better warning message when OpenSSLConf configuration elements are\n used with a JSSE TLS implementation. (markt)\n + Fix: When using OpenSSL via FFM, don\u0027t log a warning about missing CA\n certificates unless CA certificates were configured and the configuration\n failed. (markt)\n + Add: For configuration consistency between OpenSSL and JSSE TLS\n implementations, TLSv1.3 cipher suites included in the ciphers attribute\n of an SSLHostConfig are now always ignored (previously they would be\n ignored with OpenSSL implementations and used with JSSE implementations)\n and a warning is logged that the cipher suite has been ignored. (markt)\n + Add: Add the ciphersuite attribute to SSLHostConfig to configure the\n TLSv1.3 cipher suites. (markt)\n + Add: Add OCSP support to JSSE based TLS connectors and make the use of\n OCSP configurable per connector for both JSSE and OpenSSL based TLS\n implementations. Align the checks performed by OpenSSL with those\n performed by JSSE. (markt)\n + Add: Add support for soft failure of OCSP checks with soft failure support\n disabled by default. (markt)\n + Add: Add support for configuring the verification flags passed to\n OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)\n + Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.\n + Fix: Don\u0027t log an incorrect certificate KeyStore location when creating a\n TLS connector if the KeyStore instance has been set directly on the\n connector. (markt)\n + Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)\n + Add: Add strictSni attribute on the Connector to allow matching the\n SSLHostConfig configuration associated with the SNI host name to the\n SSLHostConfig configuration matched from the HTTP protocol host name. Non\n matching configurations will cause the request to be rejected. The\n attribute default value is true, enabling the matching. (remm)\n + Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)\n + Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL\n provider. Pull request #912 by aogburn. (markt)\n + Fix: Fix potential crash on shutdown when a Connector depends on the\n Tomcat Native library. (markt)\n + Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.\n * Jasper\n + Fix: 69333: Correct a regression in the previous fix for 69333 and ensure\n that reuse() or release() is always called for a tag. (markt)\n + Fix: 69877: Catch IllegalArgumentException when processing URIs when\n creating the classpath to handle invalid URIs. (remm)\n + Fix: Fix populating the classpath with the webapp classloader\n repositories. (remm)\n + Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some\n exception details. Patch submitted by Eric Blanquer. (remm)\n * Jdbc-pool\n + Fix: 64083: If the underlying connection has been closed, don\u0027t add it to\n the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)\n * Web applications\n + Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server\n status output if one or more of the web applications failed to start.\n (schultz)\n + Add: Manager: Include web application state in the HTML and JSON complete\n server status output. (markt)\n + Add: Documentation: Expand the documentation to better explain when OCSP\n is supported and when it is not. (markt)\n * Websocket\n + Fix: 69920: When attempting to write to a closed Writer or OutputStream\n obtained from a WebSocket session, throw an IOException rather than an\n IllegalStateExcpetion as required by Writer and strongly suggested by\n OutputStream. (markt)\n * Other\n + Add: Add property \u0027gpg.sign.files\u0027 to optionally disable release artefact\n signing with GPG. (rjung)\n + Add: Add test.silent property to suppress JUnit console output during test\n execution. Useful for cleaner console output when running tests with\n multiple threads. (csutherl)\n + Update: Update the internal fork of Commons Pool to 2.13.1. (markt)\n + Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)\n + Update: Update Commons Daemon to 1.5.1. (markt)\n + Update: Update to the Eclipse JDT compiler 4.37. (markt)\n + Update: Update ByteBuddy to 1.18.3. (markt)\n + Update: Update UnboundID to 7.0.4. (markt)\n + Update: Update Checkstyle to 12.3.1. (markt)\n + Add: Improvements to French translations. (markt)\n + Add: Improvements to Japanese translations provided by tak7iji. (markt)\n + Add: Improvements to Chinese translations provided by Yang. vincent.h and\n yong hu. (markt)\n + Update: Update Tomcat Native to 2.0.12. (markt)\n + Add: Add test profile system for selective test execution. Profiles can be\n specified via -Dtest.profile=\u003cname\u003e to run specific test subsets without\n using patterns directly. Profile patterns are defined in\n test-profiles.properties. (csutherl)\n + Update: Update file extension to media type mappings to align with the\n current list used by the Apache Web Server (httpd). (markt)\n + Update: Update the packaged version of the Tomcat Migration Tool for\n Jakarta EE to 1.0.10. (markt)\n + Update: Update Commons Daemon to 1.5.0. (markt)\n + Update: Update Byte Buddy to 1.18.2. (markt)\n + Update: Update Checkstyle to 12.2.0. (markt)\n + Add: Improvements to Spanish translations provided by White Vogel. (markt)\n + Add: Improvements to French translations. (remm)\n + Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)\n + Update: Update to Byte Buddy 1.17.8. (markt)\n + Update: Update to Checkstyle 12.1.1. (markt)\n + Update: Update to Jacoco 0.8.14. (markt)\n + Update: Update to SpotBugs 4.9.8. (markt)\n + Update: Update to JSign 7.4. (markt)\n + Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-877,SUSE-SLE-Module-Web-Scripting-15-SP7-2026-877,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-877,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-877,openSUSE-SLE-15.6-2026-877",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0877-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0877-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260877-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0877-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024680.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1253460",
        "url": "https://bugzilla.suse.com/1253460"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258371",
        "url": "https://bugzilla.suse.com/1258371"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258385",
        "url": "https://bugzilla.suse.com/1258385"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258387",
        "url": "https://bugzilla.suse.com/1258387"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-66614 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-66614/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24733 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24733/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24734 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24734/"
      }
    ],
    "title": "Security update for tomcat11",
    "tracking": {
      "current_release_date": "2026-03-12T05:39:40Z",
      "generator": {
        "date": "2026-03-12T05:39:40Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0877-1",
      "initial_release_date": "2026-03-12T05:39:40Z",
      "revision_history": [
        {
          "date": "2026-03-12T05:39:40Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat11-11.0.18-150600.13.15.1.noarch",
                "product": {
                  "name": "tomcat11-11.0.18-150600.13.15.1.noarch",
                  "product_id": "tomcat11-11.0.18-150600.13.15.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
                "product": {
                  "name": "tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
                  "product_id": "tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-doc-11.0.18-150600.13.15.1.noarch",
                "product": {
                  "name": "tomcat11-doc-11.0.18-150600.13.15.1.noarch",
                  "product_id": "tomcat11-doc-11.0.18-150600.13.15.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch",
                "product": {
                  "name": "tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch",
                  "product_id": "tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
                "product": {
                  "name": "tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
                  "product_id": "tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-embed-11.0.18-150600.13.15.1.noarch",
                "product": {
                  "name": "tomcat11-embed-11.0.18-150600.13.15.1.noarch",
                  "product_id": "tomcat11-embed-11.0.18-150600.13.15.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
                "product": {
                  "name": "tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
                  "product_id": "tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-jsvc-11.0.18-150600.13.15.1.noarch",
                "product": {
                  "name": "tomcat11-jsvc-11.0.18-150600.13.15.1.noarch",
                  "product_id": "tomcat11-jsvc-11.0.18-150600.13.15.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-lib-11.0.18-150600.13.15.1.noarch",
                "product": {
                  "name": "tomcat11-lib-11.0.18-150600.13.15.1.noarch",
                  "product_id": "tomcat11-lib-11.0.18-150600.13.15.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
                "product": {
                  "name": "tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
                  "product_id": "tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
                "product": {
                  "name": "tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
                  "product_id": "tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-web-scripting:15:sp7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-lib-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-lib-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-webapps-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-lib-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-lib-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-lib-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-webapps-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-lib-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-lib-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-lib-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-webapps-11.0.18-150600.13.15.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-11.0.18-150600.13.15.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat11-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-doc-11.0.18-150600.13.15.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat11-doc-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-doc-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-embed-11.0.18-150600.13.15.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat11-embed-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-embed-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-jsvc-11.0.18-150600.13.15.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat11-jsvc-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-jsvc-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-lib-11.0.18-150600.13.15.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat11-lib-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-lib-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat11-webapps-11.0.18-150600.13.15.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
        },
        "product_reference": "tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-66614",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-66614"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected.\nTomcat did not validate that the host name provided via the SNI \nextension was the same as the host name provided in the HTTP host header \nfield. If Tomcat was configured with more than one virtual host and the \nTLS configuration for one of those hosts did not require client \ncertificate authentication but another one did, it was possible for a \nclient to bypass the client certificate authentication by sending \ndifferent host names in the SNI extension and the HTTP host header field.\n\n\n\nThe vulnerability only applies if client certificate authentication is \nonly enforced at the Connector. It does not apply if client certificate \nauthentication is enforced at the web application.\n\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-doc-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-embed-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-jsvc-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-66614",
          "url": "https://www.suse.com/security/cve/CVE-2025-66614"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258371 for CVE-2025-66614",
          "url": "https://bugzilla.suse.com/1258371"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-doc-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-embed-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-jsvc-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-doc-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-embed-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-jsvc-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-12T05:39:40Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-66614"
    },
    {
      "cve": "CVE-2026-24733",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24733"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability in Apache Tomcat.\n\n\nTomcat did not limit HTTP/0.9 requests to the GET method. If a security \nconstraint was configured to allow HEAD requests to a URI but deny GET \nrequests, the user could bypass that constraint on GET requests by \nsending a (specification invalid) HEAD request using HTTP/0.9.\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.\n\n\nOlder, EOL versions are also affected.\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-doc-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-embed-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-jsvc-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24733",
          "url": "https://www.suse.com/security/cve/CVE-2026-24733"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258385 for CVE-2026-24733",
          "url": "https://bugzilla.suse.com/1258385"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-doc-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-embed-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-jsvc-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-doc-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-embed-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-jsvc-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-12T05:39:40Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24733"
    },
    {
      "cve": "CVE-2026-24734",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24734"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.\n\nWhen using an OCSP responder, Tomcat Native (and Tomcat\u0027s FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.\n\nThis issue affects Apache Tomcat Native:   from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39.  Older EOL versions are not affected.\n\nApache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.\n\nApache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-doc-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-embed-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-jsvc-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
          "openSUSE Leap 15.6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24734",
          "url": "https://www.suse.com/security/cve/CVE-2026-24734"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258387 for CVE-2026-24734",
          "url": "https://bugzilla.suse.com/1258387"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-doc-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-embed-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-jsvc-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-admin-webapps-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-doc-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-docs-webapp-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-el-6_0-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-embed-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-jsvc-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-lib-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1.noarch",
            "openSUSE Leap 15.6:tomcat11-webapps-11.0.18-150600.13.15.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-12T05:39:40Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24734"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for tomcat10",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for tomcat10 fixes the following issues:\n\nUpdate to Tomcat 10.1.52:\n\n- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).\n- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).\n- CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).\n\nChangelog:\n\n * Catalina\n + Fix: 69623: Additional fix for the long standing regression that meant\n that calls to ClassLoader.getResource().getContent() failed when made from\n within a web application with resource caching enabled if the target\n resource was packaged in a JAR file. (markt)\n + Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the\n CsrfPreventionFilter. (schultz)\n + Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2\n requests when the content-length header is not set. (dsoumis)\n + Update: Enable minimum and recommended Tomcat Native versions to be set\n separately for Tomcat Native 1.x and 2.x. Update the minimum and\n recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum\n and recommended versions for Tomcat Native 2.x to 2.0.12. (markt)\n + Add: Add a new ssoReauthenticationMode to the Tomcat provided\n Authenticators that provides a per Authenticator override of the SSO Valve\n requireReauthentication attribute. (markt)\n + Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception\n rather than silently using a replacement character. (markt)\n + Fix: 69932: Fix request end access log pattern regression, which would log\n the start time of the request instead. (remm)\n + Fix: 69871: Increase log level to INFO for missing configuration for the\n rewrite valve. (remm)\n + Fix: Add log warnings for additional Host appBase suspicious values.\n (remm)\n + Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.\n org.apache.catalina.Connector no longer requires\n org.apache.tomcat.jni.AprStatus to be present. (markt)\n + Add: Add the ability to use a custom function to generate the client\n identifier in the CrawlerSessionManagerValve. This is only available\n programmatically. Pull request #902 by Brian Matzon. (markt)\n + Fix: Change the SSO reauthentication behaviour for SPNEGO authentication\n so that a normal SPNEGO authentication is performed if the SSL Valve is\n configured with reauthentication enabled. This is so that the delegated\n credentials will be available to the web application. (markt)\n + Fix: When generating the class path in the Loader, re-order the check on\n individual class path components to avoid a potential\n NullPointerException. Identified by Coverity Scan. (markt)\n + Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull\n request #915 by Joshua Rogers. (remm)\n + Update: Add an attribute, digestInRfc3112Order, to\n MessageDigestCredentialHandler to control the order in which the\n credential and salt are digested. By default, the current, non-RFC 3112\n compliant, order of salt then credential will be used. This default will\n change in Tomcat 12 to the RFC 3112 compliant order of credential then\n salt. (markt)\n + Fix: Log warnings when the SSO configuration does not comply with the\n documentation. (remm)\n + Update: Deprecate the RemoteAddrFilter and RemoteAddrValve in favour of\n the RemoteCIDRFilter and RemoteCIDRValve. (markt)\n + Fix: 69837: Fix corruption of the class path generated by the Loader when\n running on Windows. (markt)\n + Fix: Reject requests that map to invalid Windows file names earlier.\n (markt)\n + Fix: 69839: Ensure that changes to session IDs (typically after\n authentication) are promulgated to the SSO Valve to ensure that SSO\n entries are fully clean-up on session expiration. Patch provided by Kim\n Johan Andersson. (markt)\n + Fix: Fix a race condition in the creation of the storage location for the\n FileStore. (markt)\n * Cluster\n + Add: 62814: Document that human-readable names may be used for\n mapSendOptions and align documentation with channelSendOptions. Based on\n pull request #929 by archan0621. (markt)\n * Clustering\n + Fix: Correct a regression introduced in 10.1.45 that broke some clustering\n configurations. (markt)\n * Coyote\n + Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown\n that triggered a significant memory leak. Patch provided by Wes. (markt)\n + Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm)\n + Fix: Improve warnings when setting ciphers lists in the FFM code,\n mirroring the tomcat-native changes. (remm)\n + Fix: 69910: Dereference TLS objects right after closing a socket to\n improve memory efficiency. (remm)\n + Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig\n to reflect the existing implementation that allows one configuration style\n to be used for the trust attributes and a different style for all the\n other attributes. (markt)\n + Fix: Better warning message when OpenSSLConf configuration elements are\n used with a JSSE TLS implementation. (markt)\n + Fix: When using OpenSSL via FFM, don\u0027t log a warning about missing CA\n certificates unless CA certificates were configured and the configuration\n failed. (markt)\n + Add: For configuration consistency between OpenSSL and JSSE TLS\n implementations, TLSv1.3 cipher suites included in the ciphers attribute\n of an SSLHostConfig are now always ignored (previously they would be\n ignored with OpenSSL implementations and used with JSSE implementations)\n and a warning is logged that the cipher suite has been ignored. (markt)\n + Add: Add the ciphersuite attribute to SSLHostConfig to configure the\n TLSv1.3 cipher suites. (markt)\n + Add: Add OCSP support to JSSE based TLS connectors and make the use of\n OCSP configurable per connector for both JSSE and OpenSSL based TLS\n implementations. Align the checks performed by OpenSSL with those\n performed by JSSE. (markt)\n + Add: Add support for soft failure of OCSP checks with soft failure support\n disabled by default. (markt)\n + Add: Add support for configuring the verification flags passed to\n OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)\n + Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.\n + Fix: Prevent concurrent release of OpenSSLEngine resources and the\n termination of the Tomcat Native library as it can cause crashes during\n Tomcat shutdown. (markt)\n + Fix: Don\u0027t log an incorrect certificate KeyStore location when creating a\n TLS connector if the KeyStore instance has been set directly on the\n connector. (markt)\n + Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)\n + Add: Add strictSni attribute on the Connector to allow matching the\n SSLHostConfig configuration associated with the SNI host name to the\n SSLHostConfig configuration matched from the HTTP protocol host name. Non\n matching configurations will cause the request to be rejected. The\n attribute default value is true, enabling the matching. (remm)\n + Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)\n + Fix: Fix use of deferAccept attribute in JMX, since it is normally only\n removed in Tomcat 11. (remm)\n + Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL\n provider. Pull request #912 by aogburn. (markt)\n + Fix: Fix potential crash on shutdown when a Connector depends on the\n Tomcat Native library. (markt)\n + Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.\n + Fix: 69848: Fix copy/paste errors in 10.1.47 that meant DELETE requests\n received via the AJP connector were processed as OPTIONS requests and\n PROPFIND requests were processed as TRACE. (markt)\n + Fix: Various OCSP processing issues in the OpenSSL FFM code. (dsoumis)\n * General\n + Add: Add test.silent property to suppress JUnit console output during test\n execution. Useful for cleaner console output when running tests with\n multiple threads. (csutherl)\n * Jasper\n + Fix: 69333: Correct a regression in the previous fix for 69333 and ensure\n that reuse() or release() is always called for a tag. (markt)\n + Fix: 69877: Catch IllegalArgumentException when processing URIs when\n creating the classpath to handle invalid URIs. (remm)\n + Fix: Fix populating the classpath with the webapp classloader\n repositories. (remm)\n + Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some\n exception details. Patch submitted by Eric Blanquer. (remm)\n * Jdbc-pool\n + Fix: 64083: If the underlying connection has been closed, don\u0027t add it to\n the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)\n * Web applications\n + Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server\n status output if one or more of the web applications failed to start.\n (schultz)\n + Add: Manager: Include web application state in the HTML and JSON complete\n server status output. (markt)\n + Add: Documentation: Expand the documentation to better explain when OCSP\n is supported and when it is not. (markt)\n * Websocket\n + Fix: 69920: When attempting to write to a closed Writer or OutputStream\n obtained from a WebSocket session, throw an IOException rather than an\n IllegalStateExcpetion as required by Writer and strongly suggested by\n OutputStream. (markt)\n + Fix: 69845: When using permessage-deflate with Java 25 onwards, handle the\n underlying Inflater and/or Deflater throwing IllegalStateException when\n closed rather than NullPointerException as they do in Java 24 and earlier.\n * Other\n + Update: Update the internal fork of Commons Pool to 2.13.1. (markt)\n + Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)\n + Update: Update Commons Daemon to 1.5.1. (markt)\n + Update: Update ByteBuddy to 1.18.3. (markt)\n + Update: Update UnboundID to 7.0.4. (markt)\n + Update: Update Checkstyle to 12.3.1. (markt)\n + Add: Improvements to French translations. (markt)\n + Add: Improvements to Japanese translations provided by tak7iji. (markt)\n + Add: Improvements to Chinese translations provided by Yang. vincent.h and\n yong hu. (markt)\n + Update: Update Tomcat Native to 2.0.12. (markt)\n + Add: Add property \u0027gpg.sign.files\u0027 to optionally disable release artefact\n signing with GPG. (rjung)\n + Add: Add test profile system for selective test execution. Profiles can be\n specified via -Dtest.profile=\u003cname\u003e to run specific test subsets without\n using patterns directly. Profile patterns are defined in\n test-profiles.properties. (csutherl)\n + Update: Update file extension to media type mappings to align with the\n current list used by the Apache Web Server (httpd). (markt)\n + Update: Update the packaged version of the Tomcat Migration Tool for\n Jakarta EE to 1.0.10. (markt)\n + Update: Update Commons Daemon to 1.5.0. (markt)\n + Update: Update Byte Buddy to 1.18.2. (markt)\n + Update: Update Checkstyle to 12.2.0. (markt)\n + Add: Improvements to Spanish translations provided by White Vogel. (markt)\n + Add: Improvements to French translations. (remm)\n + Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)\n + Update: Update to Byte Buddy 1.17.8. (markt)\n + Update: Update to Checkstyle 12.1.1. (markt)\n + Update: Update to Jacoco 0.8.14. (markt)\n + Update: Update to SpotBugs 4.9.8. (markt)\n + Update: Update to JSign 7.4. (markt)\n + Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-890,SUSE-SLE-Module-Web-Scripting-15-SP7-2026-890,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-890,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-890,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-890,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-890,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-890,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-890,openSUSE-SLE-15.6-2026-890",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0890-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0890-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260890-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0890-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024692.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258371",
        "url": "https://bugzilla.suse.com/1258371"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258385",
        "url": "https://bugzilla.suse.com/1258385"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258387",
        "url": "https://bugzilla.suse.com/1258387"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-66614 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-66614/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24733 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24733/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24734 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24734/"
      }
    ],
    "title": "Security update for tomcat10",
    "tracking": {
      "current_release_date": "2026-03-13T08:57:08Z",
      "generator": {
        "date": "2026-03-13T08:57:08Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0890-1",
      "initial_release_date": "2026-03-13T08:57:08Z",
      "revision_history": [
        {
          "date": "2026-03-13T08:57:08Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat10-10.1.52-150200.5.61.1.noarch",
                "product": {
                  "name": "tomcat10-10.1.52-150200.5.61.1.noarch",
                  "product_id": "tomcat10-10.1.52-150200.5.61.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
                "product": {
                  "name": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
                  "product_id": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-doc-10.1.52-150200.5.61.1.noarch",
                "product": {
                  "name": "tomcat10-doc-10.1.52-150200.5.61.1.noarch",
                  "product_id": "tomcat10-doc-10.1.52-150200.5.61.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch",
                "product": {
                  "name": "tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch",
                  "product_id": "tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
                "product": {
                  "name": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
                  "product_id": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-embed-10.1.52-150200.5.61.1.noarch",
                "product": {
                  "name": "tomcat10-embed-10.1.52-150200.5.61.1.noarch",
                  "product_id": "tomcat10-embed-10.1.52-150200.5.61.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
                "product": {
                  "name": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
                  "product_id": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-jsvc-10.1.52-150200.5.61.1.noarch",
                "product": {
                  "name": "tomcat10-jsvc-10.1.52-150200.5.61.1.noarch",
                  "product_id": "tomcat10-jsvc-10.1.52-150200.5.61.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-lib-10.1.52-150200.5.61.1.noarch",
                "product": {
                  "name": "tomcat10-lib-10.1.52-150200.5.61.1.noarch",
                  "product_id": "tomcat10-lib-10.1.52-150200.5.61.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
                "product": {
                  "name": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
                  "product_id": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
                "product": {
                  "name": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
                  "product_id": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-web-scripting:15:sp7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-lib-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-lib-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-lib-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-lib-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-lib-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-lib-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-lib-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-lib-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-lib-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-lib-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-lib-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-lib-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-lib-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-lib-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-lib-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-lib-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-lib-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-lib-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-10.1.52-150200.5.61.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat10-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-doc-10.1.52-150200.5.61.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat10-doc-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-doc-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-embed-10.1.52-150200.5.61.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat10-embed-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-embed-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-jsvc-10.1.52-150200.5.61.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat10-jsvc-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-jsvc-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-lib-10.1.52-150200.5.61.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat10-lib-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-lib-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
        },
        "product_reference": "tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-66614",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-66614"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected.\nTomcat did not validate that the host name provided via the SNI \nextension was the same as the host name provided in the HTTP host header \nfield. If Tomcat was configured with more than one virtual host and the \nTLS configuration for one of those hosts did not require client \ncertificate authentication but another one did, it was possible for a \nclient to bypass the client certificate authentication by sending \ndifferent host names in the SNI extension and the HTTP host header field.\n\n\n\nThe vulnerability only applies if client certificate authentication is \nonly enforced at the Connector. It does not apply if client certificate \nauthentication is enforced at the web application.\n\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-doc-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-embed-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-jsvc-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-66614",
          "url": "https://www.suse.com/security/cve/CVE-2025-66614"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258371 for CVE-2025-66614",
          "url": "https://bugzilla.suse.com/1258371"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-doc-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-embed-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-jsvc-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-doc-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-embed-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-jsvc-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-13T08:57:08Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-66614"
    },
    {
      "cve": "CVE-2026-24733",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24733"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability in Apache Tomcat.\n\n\nTomcat did not limit HTTP/0.9 requests to the GET method. If a security \nconstraint was configured to allow HEAD requests to a URI but deny GET \nrequests, the user could bypass that constraint on GET requests by \nsending a (specification invalid) HEAD request using HTTP/0.9.\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.\n\n\nOlder, EOL versions are also affected.\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-doc-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-embed-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-jsvc-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24733",
          "url": "https://www.suse.com/security/cve/CVE-2026-24733"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258385 for CVE-2026-24733",
          "url": "https://bugzilla.suse.com/1258385"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-doc-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-embed-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-jsvc-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-doc-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-embed-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-jsvc-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-13T08:57:08Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24733"
    },
    {
      "cve": "CVE-2026-24734",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24734"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.\n\nWhen using an OCSP responder, Tomcat Native (and Tomcat\u0027s FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.\n\nThis issue affects Apache Tomcat Native:   from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39.  Older EOL versions are not affected.\n\nApache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.\n\nApache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-doc-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-embed-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-jsvc-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
          "openSUSE Leap 15.6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24734",
          "url": "https://www.suse.com/security/cve/CVE-2026-24734"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258387 for CVE-2026-24734",
          "url": "https://bugzilla.suse.com/1258387"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-doc-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-embed-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-jsvc-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-admin-webapps-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-doc-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-docs-webapp-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-el-5_0-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-embed-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-jsp-3_1-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-jsvc-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-lib-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-servlet-6_0-api-10.1.52-150200.5.61.1.noarch",
            "openSUSE Leap 15.6:tomcat10-webapps-10.1.52-150200.5.61.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-13T08:57:08Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24734"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for tomcat",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for tomcat fixes the following issues:\n\nUpdate to Tomcat 9.0.115:\n\n- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).\n- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).\n- CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).\n  \nChangelog:\n\n * Catalina\n + Fix: 69623: Additional fix for the long standing regression that meant\n that calls to ClassLoader.getResource().getContent() failed when made from\n within a web application with resource caching enabled if the target\n resource was packaged in a JAR file. (markt)\n + Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the\n CsrfPreventionFilter. (schultz)\n + Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2\n requests when the content-length header is not set. (dsoumis)\n + Update: Update the minimum and recommended versions for Tomcat Native to\n 1.3.4. (markt)\n + Add: Add a new ssoReauthenticationMode to the Tomcat provided\n Authenticators that provides a per Authenticator override of the SSO Valve\n requireReauthentication attribute. (markt)\n + Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception\n rather than silently using a replacement character. (markt)\n + Fix: 69871: Increase log level to INFO for missing configuration for the\n rewrite valve. (remm)\n + Fix: Add log warnings for additional Host appBase suspicious values.\n (remm)\n + Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.\n org.apache.catalina.Connector no longer requires\n org.apache.tomcat.jni.AprStatus to be present. (markt)\n + Add: Add the ability to use a custom function to generate the client\n identifier in the CrawlerSessionManagerValve. This is only available\n programmatically. Pull request #902 by Brian Matzon. (markt)\n + Fix: Change the SSO reauthentication behaviour for SPNEGO authentication\n so that a normal SPNEGO authentication is performed if the SSL Valve is\n configured with reauthentication enabled. This is so that the delegated\n credentials will be available to the web application. (markt)\n + Fix: When generating the class path in the Loader, re-order the check on\n individual class path components to avoid a potential\n NullPointerException. Identified by Coverity Scan. (markt)\n + Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull\n request #915 by Joshua Rogers. (remm)\n + Update: Add an attribute, digestInRfc3112Order, to\n MessageDigestCredentialHandler to control the order in which the\n credential and salt are digested. By default, the current, non-RFC 3112\n compliant, order of salt then credential will be used. This default will\n change in Tomcat 12 to the RFC 3112 compliant order of credential then\n salt. (markt)\n * Cluster\n + Add: 62814: Document that human-readable names maybe used for\n mapSendOptions and align documentation with channelSendOptions. Based on\n pull request #929 by archan0621. (markt)\n * Clustering\n + Fix: Correct a regression introduced in 9.0.109 that broke some clustering\n configurations. (markt)\n * Coyote\n + Fix: Prevent concurrent release of OpenSSLEngine resources and the\n termination of the Tomcat Native library as it can cause crashes during\n Tomcat shutdown. (markt)\n + Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm)\n + Fix: Improve warnings when setting ciphers lists in the FFM code,\n mirroring the tomcat-native changes. (remm)\n + Fix: 69910: Dereference TLS objects right after closing a socket to\n improve memory efficiency. (remm)\n + Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig\n to reflect the existing implementation that allows one configuration style\n to be used for the trust attributes and a different style for all the\n other attributes. (markt)\n + Fix: Better warning message when OpenSSLConf configuration elements are\n used with a JSSE TLS implementation. (markt)\n + Fix: When using OpenSSL via FFM, don\u0027t log a warning about missing CA\n certificates unless CA certificates were configured and the configuration\n failed. (markt)\n + Add: For configuration consistency between OpenSSL and JSSE TLS\n implementations, TLSv1.3 cipher suites included in the ciphers attribute\n of an SSLHostConfig are now always ignored (previously they would be\n ignored with OpenSSL implementations and used with JSSE implementations)\n and a warning is logged that the cipher suite has been ignored. (markt)\n + Add: Add the ciphersuite attribute to SSLHostConfig to configure the\n TLSv1.3 cipher suites. (markt)\n + Add: Add OCSP support to JSSE based TLS connectors and make the use of\n OCSP configurable per connector for both JSSE and OpenSSL based TLS\n implementations. Align the checks performed by OpenSSL with those\n performed by JSSE. (markt)\n + Add: Add support for soft failure of OCSP checks with soft failure support\n disabled by default. (markt)\n + Add: Add support for configuring the verification flags passed to\n OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)\n + Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.\n + Fix: Don\u0027t log an incorrect certificate KeyStore location when creating a\n TLS connector if the KeyStore instance has been set directly on the\n connector. (markt)\n + Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)\n + Add: Add strictSni attribute on the Connector to allow matching the\n SSLHostConfig configuration associated with the SNI host name to the\n SSLHostConfig configuration matched from the HTTP protocol host name. Non\n matching configurations will cause the request to be rejected. The\n attribute default value is true, enabling the matching. (remm)\n + Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)\n + Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL\n provider. Pull request #912 by aogburn. (markt)\n + Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.\n * Jasper\n + Fix: 69333: Correct a regression in the previous fix for 69333 and ensure\n that reuse() or release() is always called for a tag. (markt)\n + Fix: 69877: Catch IllegalArgumentException when processing URIs when\n creating the classpath to handle invalid URIs. (remm)\n + Fix: Fix populating the classpath with the webapp classloader\n repositories. (remm)\n + Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some\n exception details. Patch submitted by Eric Blanquer. (remm)\n * Jdbc-pool\n + Fix: 64083: If the underlying connection has been closed, don\u0027t add it to\n the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)\n * Web applications\n + Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server\n status output if one or more of the web applications failed to start.\n (schultz)\n + Add: Manager: Include web application state in the HTML and JSON complete\n server status output. (markt)\n + Add: Documentation: Expand the documentation to better explain when OCSP\n is supported and when it is not. (markt)\n * Websocket\n + Fix: 69920: When attempting to write to a closed Writer or OutputStream\n obtained from a WebSocket session, throw an IOException rather than an\n IllegalStateExcpetion as required by Writer and strongly suggested by\n OutputStream. (markt)\n * Other\n + Add: Add property \u0027gpg.sign.files\u0027 to optionally disable release artefact\n signing with GPG. (rjung)\n + Add: Add test.silent property to suppress JUnit console output during test\n execution. Useful for cleaner console output when running tests with\n multiple threads. (csutherl)\n + Update: Update the internal fork of Commons Pool to 2.13.1. (markt)\n + Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)\n + Update: Update Commons Daemon to 1.5.1. (markt)\n + Update: Update ByteBuddy to 1.18.3. (markt)\n + Update: Update UnboundID to 7.0.4. (markt)\n + Update: Update Checkstyle to 12.3.1. (markt)\n + Add: Improvements to French translations. (markt)\n + Add: Improvements to Japanese translations provided by tak7iji. (markt)\n + Add: Improvements to Chinese translations provided by Yang. vincent.h and\n yong hu. (markt)\n + Update: Update Tomcat Native to 1.3.5. (markt)\n + Add: Add test profile system for selective test execution. Profiles can be\n specified via -Dtest.profile=\u003cname\u003e to run specific test subsets without\n using patterns directly. Profile patterns are defined in\n test-profiles.properties. (csutherl)\n + Update: Update file extension to media type mappings to align with the\n current list used by the Apache Web Server (httpd). (markt)\n + Update: Update Commons Daemon to 1.5.0. (markt)\n + Update: Update Byte Buddy to 1.18.2. (markt)\n + Update: Update Checkstyle to 12.2.0. (markt)\n + Add: Improvements to Spanish translations provided by White Vogel. (markt)\n + Add: Improvements to French translations. (remm)\n + Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)\n + Update: Update to Byte Buddy 1.17.8. (markt)\n + Update: Update to Checkstyle 12.1.1. (markt)\n + Update: Update to Jacoco 0.8.14. (markt)\n + Update: Update to SpotBugs 4.9.8. (markt)\n + Update: Update to JSign 7.4. (markt)\n + Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-932,SUSE-SLE-Module-Web-Scripting-15-SP7-2026-932,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-932,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-932,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-932,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-932,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-932,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-932,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-932,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-932,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-932,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-932,openSUSE-SLE-15.6-2026-932",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0932-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0932-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260932-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0932-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024774.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258371",
        "url": "https://bugzilla.suse.com/1258371"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258385",
        "url": "https://bugzilla.suse.com/1258385"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258387",
        "url": "https://bugzilla.suse.com/1258387"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-66614 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-66614/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24733 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24733/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24734 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24734/"
      }
    ],
    "title": "Security update for tomcat",
    "tracking": {
      "current_release_date": "2026-03-19T10:26:49Z",
      "generator": {
        "date": "2026-03-19T10:26:49Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0932-1",
      "initial_release_date": "2026-03-19T10:26:49Z",
      "revision_history": [
        {
          "date": "2026-03-19T10:26:49Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-9.0.115-150200.102.1.noarch",
                "product": {
                  "name": "tomcat-9.0.115-150200.102.1.noarch",
                  "product_id": "tomcat-9.0.115-150200.102.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
                "product": {
                  "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
                  "product_id": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-9.0.115-150200.102.1.noarch",
                "product": {
                  "name": "tomcat-docs-webapp-9.0.115-150200.102.1.noarch",
                  "product_id": "tomcat-docs-webapp-9.0.115-150200.102.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
                "product": {
                  "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
                  "product_id": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-embed-9.0.115-150200.102.1.noarch",
                "product": {
                  "name": "tomcat-embed-9.0.115-150200.102.1.noarch",
                  "product_id": "tomcat-embed-9.0.115-150200.102.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-javadoc-9.0.115-150200.102.1.noarch",
                "product": {
                  "name": "tomcat-javadoc-9.0.115-150200.102.1.noarch",
                  "product_id": "tomcat-javadoc-9.0.115-150200.102.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
                "product": {
                  "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
                  "product_id": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsvc-9.0.115-150200.102.1.noarch",
                "product": {
                  "name": "tomcat-jsvc-9.0.115-150200.102.1.noarch",
                  "product_id": "tomcat-jsvc-9.0.115-150200.102.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-9.0.115-150200.102.1.noarch",
                "product": {
                  "name": "tomcat-lib-9.0.115-150200.102.1.noarch",
                  "product_id": "tomcat-lib-9.0.115-150200.102.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
                "product": {
                  "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
                  "product_id": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-9.0.115-150200.102.1.noarch",
                "product": {
                  "name": "tomcat-webapps-9.0.115-150200.102.1.noarch",
                  "product_id": "tomcat-webapps-9.0.115-150200.102.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-web-scripting:15:sp7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-espos:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                  "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:15:sp6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-admin-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-lib-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-lib-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-lib-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-lib-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-lib-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-lib-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-lib-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-lib-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-lib-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
          "product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-admin-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-lib-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-lib-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-admin-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-lib-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-lib-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-lib-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-lib-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.115-150200.102.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.115-150200.102.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-9.0.115-150200.102.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat-docs-webapp-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-docs-webapp-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-embed-9.0.115-150200.102.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat-embed-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-embed-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-9.0.115-150200.102.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat-javadoc-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-javadoc-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsvc-9.0.115-150200.102.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat-jsvc-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-jsvc-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.115-150200.102.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat-lib-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-lib-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.115-150200.102.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:tomcat-webapps-9.0.115-150200.102.1.noarch"
        },
        "product_reference": "tomcat-webapps-9.0.115-150200.102.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-66614",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-66614"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected.\nTomcat did not validate that the host name provided via the SNI \nextension was the same as the host name provided in the HTTP host header \nfield. If Tomcat was configured with more than one virtual host and the \nTLS configuration for one of those hosts did not require client \ncertificate authentication but another one did, it was possible for a \nclient to bypass the client certificate authentication by sending \ndifferent host names in the SNI extension and the HTTP host header field.\n\n\n\nThe vulnerability only applies if client certificate authentication is \nonly enforced at the Connector. It does not apply if client certificate \nauthentication is enforced at the web application.\n\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-docs-webapp-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-embed-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-javadoc-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-jsvc-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-lib-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-webapps-9.0.115-150200.102.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-66614",
          "url": "https://www.suse.com/security/cve/CVE-2025-66614"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258371 for CVE-2025-66614",
          "url": "https://bugzilla.suse.com/1258371"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-docs-webapp-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-embed-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-javadoc-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-jsvc-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-lib-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-webapps-9.0.115-150200.102.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-docs-webapp-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-embed-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-javadoc-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-jsvc-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-lib-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-webapps-9.0.115-150200.102.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-19T10:26:49Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-66614"
    },
    {
      "cve": "CVE-2026-24733",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24733"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability in Apache Tomcat.\n\n\nTomcat did not limit HTTP/0.9 requests to the GET method. If a security \nconstraint was configured to allow HEAD requests to a URI but deny GET \nrequests, the user could bypass that constraint on GET requests by \nsending a (specification invalid) HEAD request using HTTP/0.9.\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.\n\n\nOlder, EOL versions are also affected.\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-docs-webapp-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-embed-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-javadoc-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-jsvc-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-lib-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-webapps-9.0.115-150200.102.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24733",
          "url": "https://www.suse.com/security/cve/CVE-2026-24733"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258385 for CVE-2026-24733",
          "url": "https://bugzilla.suse.com/1258385"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-docs-webapp-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-embed-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-javadoc-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-jsvc-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-lib-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-webapps-9.0.115-150200.102.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-docs-webapp-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-embed-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-javadoc-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-jsvc-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-lib-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-webapps-9.0.115-150200.102.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-19T10:26:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24733"
    },
    {
      "cve": "CVE-2026-24734",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24734"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.\n\nWhen using an OCSP responder, Tomcat Native (and Tomcat\u0027s FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.\n\nThis issue affects Apache Tomcat Native:   from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39.  Older EOL versions are not affected.\n\nApache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.\n\nApache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-lib-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-webapps-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-docs-webapp-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-embed-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-javadoc-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-jsvc-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-lib-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
          "openSUSE Leap 15.6:tomcat-webapps-9.0.115-150200.102.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24734",
          "url": "https://www.suse.com/security/cve/CVE-2026-24734"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258387 for CVE-2026-24734",
          "url": "https://bugzilla.suse.com/1258387"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-docs-webapp-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-embed-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-javadoc-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-jsvc-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-lib-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-webapps-9.0.115-150200.102.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15 SP7:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP4-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP5-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server 15 SP6-LTSS:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP4:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP5:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-lib-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 15 SP6:tomcat-webapps-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-admin-webapps-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-docs-webapp-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-el-3_0-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-embed-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-javadoc-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-jsp-2_3-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-jsvc-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-lib-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-servlet-4_0-api-9.0.115-150200.102.1.noarch",
            "openSUSE Leap 15.6:tomcat-webapps-9.0.115-150200.102.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-19T10:26:49Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24734"
    }
  ]
}