Packages / openSUSE Tumbleweed / Productivity/Networking/Web/Servers / tomcat

[Source: tomcat]

Package: tomcat (9.0.120-2.1)

Apache Servlet/JSP/EL Engine, RI for Servlet 4.0/JSP 2.3/EL 3.0 API

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. ATTENTION: This tomcat is built with java 1.8.0.

Other Packages Related to tomcat:

  • dep: /bin/bash

    Package not available

  • dep: /bin/sh

    Package not available

  • dep: /bin/sh

    Package not available

  • dep: /usr/bin/mkdir

    Package not available

  • dep: /usr/bin/touch

    Package not available

  • dep: [apache-commons-daemon]

    Commons Daemon - Controlling of Java Daemons

  • dep: [apache-commons-dbcp]

    Jakarta Commons DataBase Pooling Package

  • dep: [apache-commons-logging]

    Apache Commons Logging

  • dep: [apache-commons-pool2]

    Apache Commons Pool 2.x series

  • dep: [fillup]

    Tool for Merging Config Files

  • dep: java (>= 1.8)

    Package not available

  • dep: [libxslt-tools]

    Extended Stylesheet Language (XSL) Transformation utilities

  • dep: [shadow]

    Utilities to Manage User and Group Accounts

  • dep: [tomcat-lib] (= 9.0.120-2.1)

    Libraries needed to run the Tomcat Web container

  • dep: [util-linux]

    A collection of basic system utilities (core part)

  • rec: [libtcnative-1-0] (>= 1.1.24)

    Tomcat resources for performance, compatibility, etc

  • rec: [logrotate]

    Cron service for rotating, compressing, mailing and removing system log files

  • sug: [systemd]

    A System and Session Manager

Download tomcat

ArchitecturePackage sizeInstalled sizeFilesPackage
noarch218 KiB321 KiBlist of filesDownload

Package file paths (51)

Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.

  • /etc/logrotate.d/tomcat
  • /etc/tomcat
  • /etc/tomcat/allowLinking.xslt
  • /etc/tomcat/Catalina
  • /etc/tomcat/catalina.policy
  • /etc/tomcat/catalina.properties
  • /etc/tomcat/conf.d
  • /etc/tomcat/conf.d/README
  • /etc/tomcat/context.xml
  • /etc/tomcat/jaspic-providers.xml
  • /etc/tomcat/logging.properties
  • /etc/tomcat/server.xml
  • /etc/tomcat/tomcat.conf
  • /etc/tomcat/tomcat-users.xml
  • /etc/tomcat/valve.xslt
  • /etc/tomcat/web.xml
  • /srv/tomcat
  • /srv/tomcat/webapps
  • /usr/bin/tomcat-digest
  • /usr/bin/tomcat-tool-wrapper
  • /usr/libexec/tomcat
  • /usr/libexec/tomcat/functions
  • /usr/libexec/tomcat/preamble
  • /usr/libexec/tomcat/server
  • /usr/lib/systemd/system/tomcat.service
  • /usr/lib/systemd/system/tomcat@.service
  • /usr/sbin/rctomcat
  • /usr/sbin/tomcat
  • /usr/share/doc/packages/tomcat
  • /usr/share/doc/packages/tomcat/LICENSE
  • /usr/share/doc/packages/tomcat/NOTICE
  • /usr/share/doc/packages/tomcat/RELEASE-NOTES
  • /usr/share/fillup-templates/sysconfig.tomcat
  • /usr/share/tomcat
  • /usr/share/tomcat/bin/bootstrap.jar
  • /usr/share/tomcat/bin/catalina.sh
  • /usr/share/tomcat/bin/catalina-tasks.xml
  • /usr/share/tomcat/conf
  • /usr/share/tomcat/lib
  • /usr/share/tomcat/logs
  • /usr/share/tomcat/temp
  • /usr/share/tomcat/tomcat-webapps
  • /usr/share/tomcat/webapps
  • /usr/share/tomcat/work
  • /var/cache/tomcat
  • /var/cache/tomcat/Catalina
  • /var/cache/tomcat/temp
  • /var/cache/tomcat/work
  • /var/lib/tomcats
  • /var/log/tomcat
  • /var/log/tomcat/catalina.out

Field source: openSUSE Tumbleweed OSS

Use this package

OpenFactory can boot this operating system in a browser VM, or start a build that includes the native package name from this record.

Try openSUSE Tumbleweed in the browserBuild an image that includes tomcat

Versions, suites, and repositories

Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.

VersionReleaseArchitectureRepositoryPackage sizeInstalled sizePublisher repository artifact
9.0.120-2.1tumbleweed / ossnoarchopenSUSE Tumbleweed · OSS · multi-architecture218 KiB321 KiBnoarch/tomcat-9.0.120-2.1.noarch.rpm

Field source: openSUSE Tumbleweed OSS

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVESeverityVersion impact
[CVE-2026-101296]

Published:

tomcat10: CVE-2026-101296

Critical(9.1)Affected
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Affected · Fixed: 9.0.123-1.1

    dsa · tomcat · opensuse · tumbleweed

[CVE-2026-73581]

Published:

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apach

Medium(6.5)Affected
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Affected · Fixed: 9.0.122-1.1

    nvd · tomcat · opensuse · tumbleweed

[CVE-2026-65182]

Published:

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint

Critical(9.1)Affected
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Affected · Fixed: 9.0.121-1.1

    nvd · tomcat · opensuse · tumbleweed

[CVE-2024-34750]

Published:

Tomcat vulnerabilities

High(7.5)Unknown

Matching against OpenFactory catalog package versions is in progress. Observed:

Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.91-1.1

    usn · tomcat · opensuse · tumbleweed

[CVE-2014-0050]

Published:

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU con

High(7.5)Unknown

Matching against OpenFactory catalog package versions is in progress. Observed:

Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 8.0.36-3.3

    nvd · tomcat · opensuse · tumbleweed

Fixed and unaffected versions (15)
CVESeverityVersion impact
[CVE-2026-59083]

Published:

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0

High(8.2)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.120-1.1

    nvd · tomcat · opensuse · tumbleweed

[CVE-2026-50229]

Published:

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.

Medium(6.1)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.119-1.1

    nvd · tomcat · opensuse · tumbleweed

[CVE-2026-41284]

Published:

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 th

High(7.5)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.118-1.1

    nvd · tomcat · opensuse · tumbleweed

[CVE-2026-24880]

Published:

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 1

High(7.5)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.117-1.1

    nvd · tomcat · opensuse · tumbleweed

[CVE-2025-55752]

Published:

Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the pos

High(7.5)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.111-1.1

    nvd · tomcat · opensuse · tumbleweed

[CVE-2025-48989]

Published:

tomcat10: CVE-2025-48989

High(7.5)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.108-1.1

    dsa · tomcat · opensuse · tumbleweed

[CVE-2025-52434]

Published:

tomcat9: CVE-2025-52434

Medium(5.9)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.107-1.1

    dsa · tomcat · opensuse · tumbleweed

[CVE-2025-46701]

Published:

Tomcat vulnerabilities

Medium(6.5)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.106-1.1

    usn · tomcat · opensuse · tumbleweed

[CVE-2025-31650]

Published:

Tomcat vulnerabilities

High(7.5)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.104-1.1

    usn · tomcat · opensuse · tumbleweed

[CVE-2025-66614]

Published:

tomcat10: CVE-2025-66614

Critical(9.1)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.115-1.1

    dsa · tomcat · opensuse · tumbleweed

[CVE-2024-56337]

Published:

tomcat10: CVE-2024-56337

High(8.1)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.99-1.1

    dsa · tomcat · opensuse · tumbleweed

[CVE-2024-50379]

Published:

Tomcat vulnerabilities

High(8.1)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.98-1.1

    usn · tomcat · opensuse · tumbleweed

[CVE-2024-52316]

Published:

tomcat10: CVE-2024-52316

Critical(9.8)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.97-1.1

    dsa · tomcat · opensuse · tumbleweed

[CVE-2024-52317]

Published:

Tomcat vulnerabilities

Medium(6.5)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.102-1.1

    usn · tomcat · opensuse · tumbleweed

[CVE-2021-43980]

Published:

tomcat9: CVE-2021-43980

Medium(5.9)Fixed
Details (1)

  • 9.0.120-2.1 · noarch · tumbleweed

    Fixed · Fixed: 9.0.43-11.1

    dsa · tomcat · opensuse · tumbleweed

[Next results]

Last synced:

[CVE catalog]

Checksums

Repository signatures authenticate metadata. Artifact hashing is recorded separately. Neither establishes package safety.

9.0.120-2.1 / noarchObserved Sep 1, 2026sha512 8f34e7a97354…b6d8a392Source-reported digest

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Source-reported digest (sha512): 8f34e7a973549178d3ab2b02ccef9e1a43207292025119a748a3de5c3bc95983cd5c65fb30530e70ed503ecfde6a01a1a2f1ffae997d7830e38bfc7bb6d8a392

Field source: openSUSE Tumbleweed OSS

Sources

  • openSUSE Tumbleweed OSSSep 1, 2026

    Authoritative source; repository metadata signature verified

    Signature evidence

    tumbleweed-oss-multiarch:4db10cdde3ad82c7e22be35753c9e164b4bdd30f92db4aee17a0d4c94c5f902f

    Repository-signature verification record
    Signed-object SHA-256
    4db10cdde3ad82c7e22be35753c9e164b4bdd30f92db4aee17a0d4c94c5f902f
    Signer fingerprint
    AD485664E901B867051AB15F35A2F86E29B700A4
    Keyring revision
    opensuse-project-signing-key.asc
    SHA-256 b5745739ebfb95b25b8e810f9bcb847fe750ccda598bd85f02f0e974599a6d7e
    Tool and policy
    gpgv (GnuPG) 2.4.9
    openfactory-software-catalog-signature-v1
    Verification time
    Sep 1, 2026
    Repository metadata hash linkage
    Result
    Recorded as verified; digest details unavailable