Dear Team,
There is no |*examples*|directory in the Apache Tomcat
|webapps|directory. I need only 10.1.58 to resolve VA. Please assist.
Regards,
Roshan Patil,
On 8/5/2026 12:52 PM, Döscher, Andreas (ESI) via users wrote:
Moin,
examples and documentation should always be removed in productive environments,
therefore
4. If the vulnerability only affects the *examples*web application
(specifically the WebSocket chat example), would removing the
*examples*web application be considered sufficient mitigation until
the fixed version becomes available?
is the way!
Ciao,
Andreas
PS: With documentation an attacker could be able to determine the version of
the tomcat. Please consult the security-howto.html of the tomcat documentation.
-----Ursprüngliche Nachricht-----
Von: Roshan Patil<[email protected]>
Gesendet: Mittwoch, 5. August 2026 09:10
An:[email protected];[email protected]
Cc: Ahmad Hassan<[email protected]>
Betreff: Regarding apache-tomcat 10.1.58 version
**********************************************************************
Dear Team,
I hope you are doing well.
We are currently performing security remediation based on a
Vulnerability Assessment (VA) report.
The report indicates that our Apache Tomcat installation is affected
by *CVE-2026-66299*and recommends upgrading to *Apache Tomcat
10.1.58 or later*. The advisory states that the issue affects Apache Tomcat
versions *10.1.24 through 10.1.57*and is fixed in *10.1.58*.
However, we are unable to find Apache Tomcat *10.1.58*on the official
Apache Tomcat download page or archives.
The relevant portion of the VA report is as follows:
o *CVE:*CVE-2026-66299
o *Affected versions:*Apache Tomcat 10.1.24 through 10.1.57
o *Recommended remediation:*Upgrade to Apache Tomcat 10.1.58 or later.
o *Additional note:*Nessus relies on the application's
self-reported version number.
Could you please help us with the following:
1. Has Apache Tomcat *10.1.58*been officially released?
2. If not, when is it expected to be available?
3. Is there an alternative fixed version that we should upgrade to in
order to remediate CVE-2026-66299?
4. If the vulnerability only affects the *examples*web application
(specifically the WebSocket chat example), would removing the
*examples*web application be considered sufficient mitigation until
the fixed version becomes available?
We appreciate your guidance, as we need to complete our organization's security
remediation and close the VA findings.
Regards,
Roshan Patil
------------------------------------------------------------------------------------------------------------
[ C-DAC is on Social-Media too. Kindly follow us at:
Facebook:https://urldefense.com/v3/__https://www.facebook.com/CDACINDIA__;!!L8-7AA!U0klxdOOErOsRMyOyk-cIdGn01ljqxmXVvyJmh4FurKHf_kDx-qBpw6y4q85AE302jkPDXM4N2QePq4DdOm1S7OW$
& Twitter: @cdacindia ]
This e-mail is for the sole use of the intended recipient(s) and may contain
confidential and privileged information. If you are not the intended recipient,
please contact the sender by reply e-mail and destroy all copies and the
original message. Any unauthorized review, use, disclosure, dissemination,
forwarding, printing or copying of this email is strictly prohibited and
appropriate legal action will be taken.
------------------------------------------------------------------------------------------------------------
This message and any attachments are intended only for the use of the addressee
and may contain information that is privileged and confidential. If the reader
of the message is not the intended recipient or an authorized representative of
the intended recipient, you are hereby notified that any dissemination of this
communication is strictly prohibited. If you have received this communication
in error, notify the sender immediately by return email and delete the message
and any attachments from your system.
---------------------------------------------------------------------
To unsubscribe, e-mail:[email protected]
For additional commands, e-mail:[email protected]
------------------------------------------------------------------------------------------------------------
[ C-DAC is on Social-Media too. Kindly follow us at:
Facebook: https://www.facebook.com/CDACINDIA & Twitter: @cdacindia ]
This e-mail is for the sole use of the intended recipient(s) and may
contain confidential and privileged information. If you are not the
intended recipient, please contact the sender by reply e-mail and destroy
all copies and the original message. Any unauthorized review, use,
disclosure, dissemination, forwarding, printing or copying of this email
is strictly prohibited and appropriate legal action will be taken.
------------------------------------------------------------------------------------------------------------
