Database Management

Why SolarWinds Database Performance Analyzer (DPA) is not affected by multiple Apache Tomcat vulnerabilities

This article explains why SolarWinds Database Performance Analyzer (DPA) is not affected by the following Apache Tomcat vulnerabilities: CVE-2026-73581 CVE-2026-75973 CVE-2026-76183 CVE-2026-77762 CVE-2026-77791 CVE-2026-78383 CVE-2026-78437 CVE-2026-79677 CVE-2026-86248 CVE-2026-86350 CVE-2026-87022

First published date

10/22/2026 12:58 PM

Last published date

10/22/2026 12:58 PM

Overview

In 2026, the National Institute of Standards and Technology (NIST) published a security bulletin about the following vulnerabilities:

Product section

Database Performance Analyzer

Cause

CVE-2026-73581 is an improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore.

CVE-2026-75973 is an improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications.

CVE-2026-76183 is an authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. 

CVE-2026-77762 is a concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.

CVE-2026-77791 is an uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.

CVE-2026-78383 is an allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service.

CVE-2026-78437 is an incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. 

CVE-2026-79677 is a missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.

CVE-2026-86248 is a CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.

CVE-2026-86350 is an inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.

CVE-2026-87022 is an improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used.

Resolution

SolarWinds Database Performance Analyzer (DPA) is not affected by CVE-2026-73581, CVE-2026-75973, CVE-2026-76183, CVE-2026-77756, CVE-2026-77762, CVE-2026-77791, CVE-2026-78383, CVE-2026-78437, CVE-2026-79677, CVE-2026-86248, CVE-2026-86350, and CVE-2026-87022.

CVE-2026-73581: DPA does not configure SSLImplementationName override to OpenSSL/OpenSSL-FFM, so the vulnerable CRL-check path never executes.

CVE-2026-75973: DPA does not configure Jakarta Authentication (JASPIC); no SimpleAuthConfigProvider is registered, so the realm-mixup logic is never invoked.

CVE-2026-76183: DPA does not use WebSocket endpoint (ServerEndpoint/jakarta.websocket), so the security-constraint bypass has no endpoint to bypass.

CVE-2026-77762: No connector in server.xml enables the HTTP/2 UpgradeProtocol; Tomcat only serves HTTP/1.1, so the trailer-injection race is unreachable.

CVE-2026-77791: No WebSocket endpoints exist in DPA, so the close-message DoS handling path is never triggered.

CVE-2026-78383: DPA's server.xml defines no AJP connector, so the AJP thread-exhaustion bug cannot be triggered.

CVE-2026-78437: This incomplete-cleanup vulnerability is specific to the HTTP/2 implementation. No connector in DPA's server.xml enables the Http2Protocol UpgradeProtocol, so this code path is never invoked.

CVE-2026-79677: No WebSocket usage in DPA means the async-write timeout logic this vulnerability affects is never exercised.

CVE-2026-86248: DPA's HTTPS connector sets clientAuth="false" and no CLIENT-CERT auth-method exists in web.xml.

CVE-2026-86350: No connector has HTTP/2 enabled, so this HTTP/2 smuggling regression has no code path to run.

CVE-2026-87022: DPA does not implement any WebSocket endpoints.

While the component’s presence is flagged by dependency scanning tools, our analysis shows there is no associated security risk. We are tracking this dependency and plan to remove or upgrade it in a future release to fully eliminate the finding.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.