Release tomcat9-9.0.110-2.el10_2 ALSA-2026:18536

Open

#2,629 opened on May 20, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 25/100

Issue type: Bug
Clarity: Needs clarification
Activity status: Quiet
Tech stack: java
Domain: release, security

Research direction

Start by reviewing the affected tomcat9 package list and the three CVEs named in the issue, then consult the repository's release or update workflow. Done means the tomcat9-9.0.110-2.el10_2 packages are correctly processed as a security update and the release details are recorded.

Written by the indexing model from the issue text.

Description

tomcat9 security update
Severity: Important
Description
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

tomcat: Apache Tomcat: Security constraint bypass for CGI scripts (CVE-2025-46701)
org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve (CVE-2025-55668)
org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation (CVE-2025-55754)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Affected packages:
tomcat9-9.0.110-2.el10_2.noarch
tomcat9-admin-webapps-9.0.110-2.el10_2.noarch
tomcat9-docs-webapp-9.0.110-2.el10_2.noarch
tomcat9-el-3.0-api-9.0.110-2.el10_2.noarch
tomcat9-jsp-2.3-api-9.0.110-2.el10_2.noarch
tomcat9-lib-9.0.110-2.el10_2.noarch
tomcat9-servlet-4.0-api-9.0.110-2.el10_2.noarch
tomcat9-webapps-9.0.110-2.el10_2.noarch
tomcat9-9.0.110-2.el10_2.noarch
tomcat9-admin-webapps-9.0.110-2.el10_2.noarch
tomcat9-docs-webapp-9.0.110-2.el10_2.noarch
tomcat9-el-3.0-api-9.0.110-2.el10_2.noarch
tomcat9-jsp-2.3-api-9.0.110-2.el10_2.noarch
tomcat9-lib-9.0.110-2.el10_2.noarch
tomcat9-servlet-4.0-api-9.0.110-2.el10_2.noarch
tomcat9-webapps-9.0.110-2.el10_2.noarch
tomcat9-9.0.110-2.el10_2.noarch
tomcat9-admin-webapps-9.0.110-2.el10_2.noarch
tomcat9-docs-webapp-9.0.110-2.el10_2.noarch
tomcat9-el-3.0-api-9.0.110-2.el10_2.noarch
tomcat9-jsp-2.3-api-9.0.110-2.el10_2.noarch
tomcat9-lib-9.0.110-2.el10_2.noarch
tomcat9-servlet-4.0-api-9.0.110-2.el10_2.noarch
tomcat9-webapps-9.0.110-2.el10_2.noarch
tomcat9-9.0.110-2.el10_2.noarch
tomcat9-admin-webapps-9.0.110-2.el10_2.noarch
tomcat9-docs-webapp-9.0.110-2.el10_2.noarch
tomcat9-el-3.0-api-9.0.110-2.el10_2.noarch
tomcat9-jsp-2.3-api-9.0.110-2.el10_2.noarch
tomcat9-lib-9.0.110-2.el10_2.noarch
tomcat9-servlet-4.0-api-9.0.110-2.el10_2.noarch
tomcat9-webapps-9.0.110-2.el10_2.noarch
tomcat9-9.0.110-2.el10_2.noarch
tomcat9-admin-webapps-9.0.110-2.el10_2.noarch
tomcat9-docs-webapp-9.0.110-2.el10_2.noarch
tomcat9-el-3.0-api-9.0.110-2.el10_2.noarch
tomcat9-jsp-2.3-api-9.0.110-2.el10_2.noarch
tomcat9-lib-9.0.110-2.el10_2.noarch
tomcat9-servlet-4.0-api-9.0.110-2.el10_2.noarch
tomcat9-webapps-9.0.110-2.el10_2.noarch

Dominant language: No language data
Stars: 2
Forks: 0
PR merge metrics: No merged PRs in 30d

Getting set up

No Dockerfile or Docker Compose file
No pull request template
Read the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

main prepack rejects the missing beta.2 updater inventory
Possibly taken @shakkernerd claimed this today. Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 76/100

openclaw/openclaw#166914 · 1 comment · 1 reaction · Opened Oct 8, 2026

Maintainers usually reply within 1 day
Release 1.0.1 fails to load on Sublime Text 4200: .python-version is missing from the installed package
Open
- Is something wrong?
Difficulty 1/5 Under an hour Newbie friendliness 64/100

sublimelsp/LSP-systemd#6 · Opened Oct 8, 2026
A 20.x release after 21.0.0 would move `latest` back to 20.x, and `next` stays on the release candidate
Possibly taken @armando-navarro claimed this today. Open
- Is something wrong?
comp: build/pipeline type: bug version: current (v17+)

Difficulty 2/5 1-3 hours Newbie friendliness 85/100

angular/angularfire#3790 · Opened Oct 8, 2026

Maintainers usually reply within 3 days
release: first non-pre-release (v0.1.0-beta)
Open
- Is something wrong?
area: ci priority: P1 type: build

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

crocodile-labs/openmoat#322 · Opened Oct 7, 2026

Maintainers usually reply within 1 day
bug(base-anvil): custom manual builds overwrite the documented immutable SHA tag
Open
- Is something wrong?
Difficulty 2/5 1-3 hours Newbie friendliness 73/100

base/base#5648 · Opened Oct 7, 2026

Maintainers usually reply within 1 day

More Release issues

Release tomcat9-9.0.110-2.el10_2 ALSA-2026:18536

Is something wrong?

Assessment

Research direction

Description

Getting set up

First steps

More from AlmaLinux/updates

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Similar issues

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Is something wrong?

Get new issues in your inbox