{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/debian11els/vex/2026/cve-2026-73180-els_os-debian11els.json" } ], "tracking": { "current_release_date": "2026-09-15T09:00:44Z", "generator": { "date": "2026-09-15T09:00:44Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-73180-ELS_OS-DEBIAN11ELS", "initial_release_date": "2026-08-25T22:17:00Z", "revision_history": [ { "date": "2026-08-25T22:17:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-09-15T09:00:44Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2026-73180" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 11", "product": { "name": "Debian 11", "product_id": "Debian-11", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" }, { "branches": [ { "category": "product_version", "name": "tomcat9-user-0:9.0.118-0+deb11u1.all", "product": { "name": "tomcat9-user-0:9.0.118-0+deb11u1.all", "product_id": "tomcat9-user-0:9.0.118-0+deb11u1.all", "product_identification_helper": { "purl": "pkg:deb/debian/tomcat9-user@9.0.118-0%2Bdeb11u1?arch=all" } } }, { "category": "product_version", "name": "tomcat9-examples-0:9.0.118-0+deb11u1.all", "product": { "name": "tomcat9-examples-0:9.0.118-0+deb11u1.all", "product_id": "tomcat9-examples-0:9.0.118-0+deb11u1.all", "product_identification_helper": { "purl": "pkg:deb/debian/tomcat9-examples@9.0.118-0%2Bdeb11u1?arch=all" } } }, { "category": "product_version", "name": "tomcat9-common-0:9.0.118-0+deb11u1.all", "product": { "name": "tomcat9-common-0:9.0.118-0+deb11u1.all", "product_id": "tomcat9-common-0:9.0.118-0+deb11u1.all", "product_identification_helper": { "purl": "pkg:deb/debian/tomcat9-common@9.0.118-0%2Bdeb11u1?arch=all" } } }, { "category": "product_version", "name": "libtomcat9-java-0:9.0.118-0+deb11u1.all", "product": { "name": "libtomcat9-java-0:9.0.118-0+deb11u1.all", "product_id": "libtomcat9-java-0:9.0.118-0+deb11u1.all", "product_identification_helper": { "purl": "pkg:deb/debian/libtomcat9-java@9.0.118-0%2Bdeb11u1?arch=all" } } }, { "category": "product_version", "name": "tomcat9-0:9.0.118-0+deb11u1.all", "product": { "name": "tomcat9-0:9.0.118-0+deb11u1.all", "product_id": "tomcat9-0:9.0.118-0+deb11u1.all", "product_identification_helper": { "purl": "pkg:deb/debian/tomcat9@9.0.118-0%2Bdeb11u1?arch=all" } } }, { "category": "product_version", "name": "tomcat9-docs-0:9.0.118-0+deb11u1.all", "product": { "name": "tomcat9-docs-0:9.0.118-0+deb11u1.all", "product_id": "tomcat9-docs-0:9.0.118-0+deb11u1.all", "product_identification_helper": { "purl": "pkg:deb/debian/tomcat9-docs@9.0.118-0%2Bdeb11u1?arch=all" } } }, { "category": "product_version", "name": "tomcat9-admin-0:9.0.118-0+deb11u1.all", "product": { "name": "tomcat9-admin-0:9.0.118-0+deb11u1.all", "product_id": "tomcat9-admin-0:9.0.118-0+deb11u1.all", "product_identification_helper": { "purl": "pkg:deb/debian/tomcat9-admin@9.0.118-0%2Bdeb11u1?arch=all" } } }, { "category": "product_version", "name": "libtomcat9-embed-java-0:9.0.118-0+deb11u1.all", "product": { "name": "libtomcat9-embed-java-0:9.0.118-0+deb11u1.all", "product_id": "libtomcat9-embed-java-0:9.0.118-0+deb11u1.all", "product_identification_helper": { "purl": "pkg:deb/debian/libtomcat9-embed-java@9.0.118-0%2Bdeb11u1?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "tomcat9-user-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product": { "name": "tomcat9-user-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_id": "tomcat9-user-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/tomcat9-user@9.0.118-0%2Bdeb11u1%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "tomcat9-examples-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product": { "name": "tomcat9-examples-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_id": "tomcat9-examples-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/tomcat9-examples@9.0.118-0%2Bdeb11u1%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "tomcat9-common-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product": { "name": "tomcat9-common-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_id": "tomcat9-common-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/tomcat9-common@9.0.118-0%2Bdeb11u1%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "libtomcat9-java-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product": { "name": "libtomcat9-java-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_id": "libtomcat9-java-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libtomcat9-java@9.0.118-0%2Bdeb11u1%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "tomcat9-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product": { "name": "tomcat9-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_id": "tomcat9-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/tomcat9@9.0.118-0%2Bdeb11u1%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "tomcat9-docs-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product": { "name": "tomcat9-docs-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_id": "tomcat9-docs-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/tomcat9-docs@9.0.118-0%2Bdeb11u1%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "tomcat9-admin-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product": { "name": "tomcat9-admin-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_id": "tomcat9-admin-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/tomcat9-admin@9.0.118-0%2Bdeb11u1%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "libtomcat9-embed-java-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product": { "name": "libtomcat9-embed-java-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_id": "libtomcat9-embed-java-0:9.0.118-0+deb11u1+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/libtomcat9-embed-java@9.0.118-0%2Bdeb11u1%2Btuxcare.els1?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat9-user-0:9.0.118-0+deb11u1+tuxcare.els1.all as a component of Debian 11", "product_id": "Debian-11:tomcat9-user-0:9.0.118-0+deb11u1+tuxcare.els1.all" }, "product_reference": "tomcat9-user-0:9.0.118-0+deb11u1+tuxcare.els1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-user-0:9.0.118-0+deb11u1.all as a component of Debian 11", "product_id": "Debian-11:tomcat9-user-0:9.0.118-0+deb11u1.all" }, "product_reference": "tomcat9-user-0:9.0.118-0+deb11u1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-examples-0:9.0.118-0+deb11u1+tuxcare.els1.all as a component of Debian 11", "product_id": "Debian-11:tomcat9-examples-0:9.0.118-0+deb11u1+tuxcare.els1.all" }, "product_reference": "tomcat9-examples-0:9.0.118-0+deb11u1+tuxcare.els1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-examples-0:9.0.118-0+deb11u1.all as a component of Debian 11", "product_id": "Debian-11:tomcat9-examples-0:9.0.118-0+deb11u1.all" }, "product_reference": "tomcat9-examples-0:9.0.118-0+deb11u1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-common-0:9.0.118-0+deb11u1+tuxcare.els1.all as a component of Debian 11", "product_id": "Debian-11:tomcat9-common-0:9.0.118-0+deb11u1+tuxcare.els1.all" }, "product_reference": "tomcat9-common-0:9.0.118-0+deb11u1+tuxcare.els1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-common-0:9.0.118-0+deb11u1.all as a component of Debian 11", "product_id": "Debian-11:tomcat9-common-0:9.0.118-0+deb11u1.all" }, "product_reference": "tomcat9-common-0:9.0.118-0+deb11u1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libtomcat9-java-0:9.0.118-0+deb11u1+tuxcare.els1.all as a component of Debian 11", "product_id": "Debian-11:libtomcat9-java-0:9.0.118-0+deb11u1+tuxcare.els1.all" }, "product_reference": "libtomcat9-java-0:9.0.118-0+deb11u1+tuxcare.els1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libtomcat9-java-0:9.0.118-0+deb11u1.all as a component of Debian 11", "product_id": "Debian-11:libtomcat9-java-0:9.0.118-0+deb11u1.all" }, "product_reference": "libtomcat9-java-0:9.0.118-0+deb11u1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-0:9.0.118-0+deb11u1+tuxcare.els1.all as a component of Debian 11", "product_id": "Debian-11:tomcat9-0:9.0.118-0+deb11u1+tuxcare.els1.all" }, "product_reference": "tomcat9-0:9.0.118-0+deb11u1+tuxcare.els1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-0:9.0.118-0+deb11u1.all as a component of Debian 11", "product_id": "Debian-11:tomcat9-0:9.0.118-0+deb11u1.all" }, "product_reference": "tomcat9-0:9.0.118-0+deb11u1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-docs-0:9.0.118-0+deb11u1+tuxcare.els1.all as a component of Debian 11", "product_id": "Debian-11:tomcat9-docs-0:9.0.118-0+deb11u1+tuxcare.els1.all" }, "product_reference": "tomcat9-docs-0:9.0.118-0+deb11u1+tuxcare.els1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-docs-0:9.0.118-0+deb11u1.all as a component of Debian 11", "product_id": "Debian-11:tomcat9-docs-0:9.0.118-0+deb11u1.all" }, "product_reference": "tomcat9-docs-0:9.0.118-0+deb11u1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-admin-0:9.0.118-0+deb11u1+tuxcare.els1.all as a component of Debian 11", "product_id": "Debian-11:tomcat9-admin-0:9.0.118-0+deb11u1+tuxcare.els1.all" }, "product_reference": "tomcat9-admin-0:9.0.118-0+deb11u1+tuxcare.els1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat9-admin-0:9.0.118-0+deb11u1.all as a component of Debian 11", "product_id": "Debian-11:tomcat9-admin-0:9.0.118-0+deb11u1.all" }, "product_reference": "tomcat9-admin-0:9.0.118-0+deb11u1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libtomcat9-embed-java-0:9.0.118-0+deb11u1+tuxcare.els1.all as a component of Debian 11", "product_id": "Debian-11:libtomcat9-embed-java-0:9.0.118-0+deb11u1+tuxcare.els1.all" }, "product_reference": "libtomcat9-embed-java-0:9.0.118-0+deb11u1+tuxcare.els1.all", "relates_to_product_reference": "Debian-11" }, { "category": "default_component_of", "full_product_name": { "name": "libtomcat9-embed-java-0:9.0.118-0+deb11u1.all as a component of Debian 11", "product_id": "Debian-11:libtomcat9-embed-java-0:9.0.118-0+deb11u1.all" }, "product_reference": "libtomcat9-embed-java-0:9.0.118-0+deb11u1.all", "relates_to_product_reference": "Debian-11" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-73180", "cwe": { "id": "CWE-613", "name": "Insufficient Session Expiration" }, "notes": [ { "category": "description", "text": "Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.", "title": "Vulnerability description" } ], "product_status": { "known_affected": [ "Debian-11:libtomcat9-embed-java-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:libtomcat9-embed-java-0:9.0.118-0+deb11u1.all", "Debian-11:libtomcat9-java-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:libtomcat9-java-0:9.0.118-0+deb11u1.all", "Debian-11:tomcat9-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:tomcat9-0:9.0.118-0+deb11u1.all", "Debian-11:tomcat9-admin-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:tomcat9-admin-0:9.0.118-0+deb11u1.all", "Debian-11:tomcat9-common-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:tomcat9-common-0:9.0.118-0+deb11u1.all", "Debian-11:tomcat9-docs-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:tomcat9-docs-0:9.0.118-0+deb11u1.all", "Debian-11:tomcat9-examples-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:tomcat9-examples-0:9.0.118-0+deb11u1.all", "Debian-11:tomcat9-user-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:tomcat9-user-0:9.0.118-0+deb11u1.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-73180" }, { "category": "external", "summary": "https://lists.apache.org/thread/3j15vztszpyqss253mjq5v1kp7s6hooq", "url": "https://lists.apache.org/thread/3j15vztszpyqss253mjq5v1kp7s6hooq" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/08/26/10", "url": "http://www.openwall.com/lists/oss-security/2026/08/26/10" } ], "release_date": "2026-08-25T22:17:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-09-01T14:13:31.164607Z", "details": "Deprioritize this CVE because it only affects applications that use Jakarta WebSocket endpoints tied to an authenticated HTTP session and specifically rotate the HTTP session ID after the WebSocket is established; applications without WebSockets or that don’t bind WebSocket authorization to the container session are unaffected. Exploitation requires an already-authenticated user and precise session timing to keep their own WebSocket alive after logout, yielding no privilege escalation or code execution and only low confidentiality/integrity risk to that single session, with no availability impact. Given the high attack complexity, prerequisite conditions, and narrow, application-specific impact surface, this is a low operational risk in typical enterprise VM/server deployments.", "product_ids": [ "Debian-11:libtomcat9-embed-java-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:libtomcat9-embed-java-0:9.0.118-0+deb11u1.all", "Debian-11:libtomcat9-java-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:libtomcat9-java-0:9.0.118-0+deb11u1.all", "Debian-11:tomcat9-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:tomcat9-0:9.0.118-0+deb11u1.all", "Debian-11:tomcat9-admin-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:tomcat9-admin-0:9.0.118-0+deb11u1.all", "Debian-11:tomcat9-common-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:tomcat9-common-0:9.0.118-0+deb11u1.all", "Debian-11:tomcat9-docs-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:tomcat9-docs-0:9.0.118-0+deb11u1.all", "Debian-11:tomcat9-examples-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:tomcat9-examples-0:9.0.118-0+deb11u1.all", "Debian-11:tomcat9-user-0:9.0.118-0+deb11u1+tuxcare.els1.all", "Debian-11:tomcat9-user-0:9.0.118-0+deb11u1.all" ] } ] } ] }