Description of the patch:
This update for tomcat fixes the following issues
Update to Tomcat 9.0.119.
Security issues fixed:
- CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
- CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be
skipped if the first condition in an OR chain matched (bsc#1269910).
- CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
- CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints
to not be included when the effective web.xml was logged (bsc#1269909).
- CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster
component (bsc#1269908).
- CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any
method or method omission configured as part of the constraint (bsc#1269907).
Other updates and bugfixes:
- Tomcat 9.0.119:
- Catalina
- Add: Add support for literal '%' characters in access log output. Based on
pull request #1002 by Fabian Hahn. (markt)
- Fix: Prevent duplicate log messages when clustering JARs are not present
on startup. (csutherl)
- Code: Remove unnecessary code from the SSI processing engine that was
duplicating some of the normalisation checks. (markt)
- Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
- Fix: Avoid some NPEs in the Connector class on an uninitialize protocol.
(remm)
- Fix: Incorrect session average life calculation. (remm)
- Fix: Improve robustness on using Pipeline.setBasic on a running pipeline.
(remm)
- Fix: Avoid any init parameter updates when conflicts are found for
filters, similar to what is done for servlets, as required by the servlet
specification. (remm)...