{"schema_version":"1.7.2","id":"OESA-2026-3233","modified":"2026-08-07T02:41:26Z","published":"2026-08-07T02:41:26Z","upstream":["CVE-2026-66299"],"summary":"tomcat security update","details":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nUncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.(CVE-2026-66299)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"tomcat","purl":"pkg:rpm/openEuler/tomcat&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.120-2.oe2403sp1"}]}],"ecosystem_specific":{"noarch":["tomcat-9.0.120-2.oe2403sp1.noarch.rpm","tomcat-help-9.0.120-2.oe2403sp1.noarch.rpm","tomcat-jsvc-9.0.120-2.oe2403sp1.noarch.rpm"],"src":["tomcat-9.0.120-2.oe2403sp1.src.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP3","name":"tomcat","purl":"pkg:rpm/openEuler/tomcat&distro=openEuler-24.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.120-2.oe2403sp3"}]}],"ecosystem_specific":{"noarch":["tomcat-9.0.120-2.oe2403sp3.noarch.rpm","tomcat-help-9.0.120-2.oe2403sp3.noarch.rpm","tomcat-jsvc-9.0.120-2.oe2403sp3.noarch.rpm"],"src":["tomcat-9.0.120-2.oe2403sp3.src.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP4","name":"tomcat","purl":"pkg:rpm/openEuler/tomcat&distro=openEuler-24.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.120-2.oe2403sp4"}]}],"ecosystem_specific":{"noarch":["tomcat-9.0.120-2.oe2403sp4.noarch.rpm","tomcat-help-9.0.120-2.oe2403sp4.noarch.rpm","tomcat-jsvc-9.0.120-2.oe2403sp4.noarch.rpm"],"src":["tomcat-9.0.120-2.oe2403sp4.src.rpm"]}},{"package":{"ecosystem":"openEuler:20.03-LTS-SP4","name":"tomcat","purl":"pkg:rpm/openEuler/tomcat&distro=openEuler-20.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.120-2.oe2003sp4"}]}],"ecosystem_specific":{"noarch":["tomcat-9.0.120-2.oe2003sp4.noarch.rpm","tomcat-help-9.0.120-2.oe2003sp4.noarch.rpm","tomcat-jsvc-9.0.120-2.oe2003sp4.noarch.rpm"],"src":["tomcat-9.0.120-2.oe2003sp4.src.rpm"]}},{"package":{"ecosystem":"openEuler:22.03-LTS-SP4","name":"tomcat","purl":"pkg:rpm/openEuler/tomcat&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.120-2.oe2203sp4"}]}],"ecosystem_specific":{"noarch":["tomcat-9.0.120-2.oe2203sp4.noarch.rpm","tomcat-help-9.0.120-2.oe2203sp4.noarch.rpm","tomcat-jsvc-9.0.120-2.oe2203sp4.noarch.rpm"],"src":["tomcat-9.0.120-2.oe2203sp4.src.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3233"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66299"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"database_specific":{"severity":"High"}}