The update fixes numerous security issues in libtcnative and Apache Tomcat components, including CVE-2026-73581 where OpenSSL and OpenSSL-FFM TLS implementations ignored certificate revocation lists when using a keystore, CVE-2026-75973 involving improper authentication with Jakarta authentication configured with SimpleAuthConfigProvider, and CVE-2026-76183 which allows bypassing security constraints on any WebSocket endpoint. Other critical fixes address denial of service vulnerabilities caused by resource exhaustion (CVE-2026-78383), malformed requests causing request failures (CVE-2026-78437), HTTP/2 request header mix-ups and request smuggling (CVE-2026-86350), and WebSocket message smuggling (CVE-2026-87022). The update also includes enhancements to OpenSSL 3.0.x support, removal of deprecated calls, and improved robustness in certificate verification and OCSP handling.

Exploitation of these vulnerabilities could lead to bypass of authentication mechanisms, unauthorized access to WebSocket endpoints, denial of service conditions through resource exhaustion or malformed requests, HTTP request smuggling attacks, and JVM crashes during TLS handshakes. These impacts affect the confidentiality, integrity, and availability of services running Apache Tomcat and using libtcnative with affected OpenSSL versions.

A security update is available that fixes all listed vulnerabilities. Users should apply the update to libtcnative-1-0 (version 1.3.9), libtcnative-2-0 (version 2.0.16), and Apache Tomcat 10 and 11 as provided by the SUSE Product Security Team. The update includes fixes for all security issues and improvements in OpenSSL support. No additional mitigation steps are required beyond applying the official update.