Release tomcat-9.0.110-2.el9_8 ALSA-2026:18916

tomcat security update
Severity: Important
Description
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Security constraint bypass for CGI scripts (CVE-2025-46701)
* org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve (CVE-2025-55668)
* org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation (CVE-2025-55754)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

Affected packages:
tomcat-9.0.110-2.el9_8.noarch
tomcat-admin-webapps-9.0.110-2.el9_8.noarch
tomcat-docs-webapp-9.0.110-2.el9_8.noarch
tomcat-el-3.0-api-9.0.110-2.el9_8.noarch
tomcat-jsp-2.3-api-9.0.110-2.el9_8.noarch
tomcat-lib-9.0.110-2.el9_8.noarch
tomcat-servlet-4.0-api-9.0.110-2.el9_8.noarch
tomcat-webapps-9.0.110-2.el9_8.noarch
tomcat-9.0.110-2.el9_8.noarch
tomcat-admin-webapps-9.0.110-2.el9_8.noarch
tomcat-docs-webapp-9.0.110-2.el9_8.noarch
tomcat-el-3.0-api-9.0.110-2.el9_8.noarch
tomcat-jsp-2.3-api-9.0.110-2.el9_8.noarch
tomcat-lib-9.0.110-2.el9_8.noarch
tomcat-servlet-4.0-api-9.0.110-2.el9_8.noarch
tomcat-webapps-9.0.110-2.el9_8.noarch
tomcat-9.0.110-2.el9_8.noarch
tomcat-admin-webapps-9.0.110-2.el9_8.noarch
tomcat-docs-webapp-9.0.110-2.el9_8.noarch
tomcat-el-3.0-api-9.0.110-2.el9_8.noarch
tomcat-jsp-2.3-api-9.0.110-2.el9_8.noarch
tomcat-lib-9.0.110-2.el9_8.noarch
tomcat-servlet-4.0-api-9.0.110-2.el9_8.noarch
tomcat-webapps-9.0.110-2.el9_8.noarch
tomcat-9.0.110-2.el9_8.noarch
tomcat-admin-webapps-9.0.110-2.el9_8.noarch
tomcat-docs-webapp-9.0.110-2.el9_8.noarch
tomcat-el-3.0-api-9.0.110-2.el9_8.noarch
tomcat-jsp-2.3-api-9.0.110-2.el9_8.noarch
tomcat-lib-9.0.110-2.el9_8.noarch
tomcat-servlet-4.0-api-9.0.110-2.el9_8.noarch
tomcat-webapps-9.0.110-2.el9_8.noarch