PT-2026-40068 · Apache+2 · Apache Tomcat+2

Dariusz Gońda · Publicado 2026-05-12 · Atualizado 2026-06-11 · CVE-2026-41284

Positive Technologies (AI Summary) · Pt

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Nome do Software Vulnerável e Versões Afetadas Apache Tomcat versões 11.0.0-M1 até 11.0.21 Apache Tomcat versões 10.1.0-M1 até 10.1.54 Apache Tomcat versões 9.0.0.M1 até 9.0.117

Descrição Existe um problema envolvendo a alocação de recursos sem limites ou controle de fluxo (throttling).

Recomendações Atualize para a versão corrigida para as versões afetadas do Apache Tomcat.

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

BDU:2026-08084

BIT-TOMCAT-2026-41284

CVE-2026-41284

GHSA-GX5V-XP9W-J4CG

OESA-2026-2296

OPENSUSE-SU-2026:10925-1

OPENSUSE-SU-2026:10926-1

OPENSUSE-SU-2026:10927-1

SUSE-SU-2026:2374-1

SUSE-SU-2026:2377-1

USN-8417-1

Produtos afetados

Apache Tomcat

Red Os

Ubuntu

Referências · 63

• https://github.com/apache/tomcat/commit/b3d1c1c239142e806be0b7329d304b94a58913ed · Nota
• https://github.com/apache/tomcat/commit/17dacd9aa48628da2eba37a9ab743c0b6c71685c · Nota
• https://github.com/apache/tomcat/commit/a96fffd18487a29c0a30d36f00cb2b2d91f6d42c · Nota
• https://github.com/apache/tomcat · Nota
• https://suse.com/security/cve/CVE-2026-43512 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-tomcat10-cve-2026-41284-8.0 · Nota
• https://bugzilla.suse.com/1265145 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-tomcat-cve-2026-41284-8.0 · Nota
• https://bugzilla.suse.com/1265163 · Nota
• https://ubuntu.com/security/notices/USN-8417-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-41293 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-42498 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-43512 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-tomcat11-cve-2026-41284-8.0 · Nota
• https://suse.com/security/cve/CVE-2026-43514 · Nota