Debian Trixie Updates Tomcat 10 for 19 Security Vulnerabilities
Tech GuruQuick Answer
Deploy tomcat10 10.1.60-1~deb13u1 through the trixie security repository. Restart affected instances and validate application traffic and connector behavior.
Confirm Scope And Apply The Supported Remediation
What to do now: Record Debian suite, Tomcat packages, running instances, connectors, reverse proxies and deployed applications. Match Debian trixie package origin and versions; evaluate other distributions and upstream installations against their own supported guidance. Apply the Debian security update through the approved package-management process and ensure running instances use the corrected code. Verify installed and running versions, application authentication, request handling and service health. Retain package output, connector configuration and access/error logs.
Last verified: 2026-11-13 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Debian 13 trixie tomcat10 packages |
|---|---|
| Advisory | DSA-6623-1 |
| CVEs | CVE-2026-50229, CVE-2026-53404, CVE-2026-53434, CVE-2026-55276, CVE-2026-55955, CVE-2026-55956, CVE-2026-59083, CVE-2026-59084, CVE-2026-65182, CVE-2026-65183, CVE-2026-65637, CVE-2026-65905, CVE-2026-65927, CVE-2026-66299, CVE-2026-66422, CVE-2026-68525, CVE-2026-68569, CVE-2026-68763, CVE-2026-73180 |
| Authoritative release date | 2026-11-12 — November 12, 2026 at 23:09:58 UTC, from the signed announcement message header. The advisory heading and feed carry November 13, 2026. |
| Authority revision date | No separate revision date is provided by the authority. |
| Affected versions | Debian trixie tomcat10 packages requiring this update; the tracker identifies 10.1.55-1~deb13u1 as vulnerable. |
| Fixed version | tomcat10 10.1.60-1~deb13u1 for Debian trixie |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Debian does not confirm exploitation in the wild in this advisory.; no exploitation claim is inferred. |
What Changed
Debian releases a Tomcat 10 security update covering information disclosure, HTTP request smuggling and denial of service.
What To Validate Now
- Inventory. Record Debian suite, Tomcat packages, running instances, connectors, reverse proxies and deployed applications.
- Establish applicability. Match Debian trixie package origin and versions; evaluate other distributions and upstream installations against their own supported guidance.
- Remediate. Apply the Debian security update through the approved package-management process and ensure running instances use the corrected code.
- Validate. Verify installed and running versions, application authentication, request handling and service health. Retain package output, connector configuration and access/error logs.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Stage compatibility and proxy-path testing before rollout. Coordinate restarts and recovery for stateful applications; the advisory does not state that all CVEs affect every enabled feature.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
