Apache Tomcat Patches 8 Vulnerabilities, 2 Critical Authentication Bypass Flaws

Key Takeaways

• Apache Tomcat has released patches for eight security vulnerabilities, including two critical authentication bypass flaws.
• The vulnerabilities affect various versions across Tomcat 11, 10, and 9 branches, with specific impacts depending on the configuration.
• The most severe issues involve bypassing password checks in JNDIRealm and mixing user requests/responses in HTTP/2 processing.
• Immediate patching is recommended for all affected deployments to mitigate risks of unauthorized access and data leakage.

Apache Tomcat Addresses Eight Security Flaws, Including Critical Authentication Bypasses

Apache Software Foundation has issued patches for a suite of eight security vulnerabilities impacting its widely used Tomcat web server. The fixes, released on October 20, 2026, address issues ranging from critical authentication bypasses to data exposure risks and connection disruptions under specific operational conditions.

The vulnerabilities span different Tomcat release branches, with fixes integrated into Tomcat versions 11.0.27, 10.1.61, and 9.0.123. Administrators are urged to review their deployments, as not every flaw affects every version, and the severity often hinges on specific configurations and enabled features.

Apache has categorized three of the discovered flaws as “Important” and five as “Low” severity. The most significant concerns revolve around authentication mechanisms, HTTP/2 request handling, and AJP response processing, each presenting distinct risks depending on the environment.

Critical Authentication Bypass and Data Exposure Risks

One of the most critical vulnerabilities, identified as CVE-2026-101296, targets the JNDIRealm component when configured with a non-GSSAPI SASL authentication mechanism. This flaw stems from a missing validation step, which attackers could exploit to authenticate without providing the correct password. This bypass is not a universal login vulnerability but specifically impacts Tomcat versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122.

It is crucial to note that CVE-2026-101296 is distinct from a previously disclosed GSSAPI-related JNDIRealm bypass. Administrators must verify their specific SASL authentication settings rather than solely relying on the component name.

Another “Important” flaw, CVE-2026-101356, involves improper recycling and reuse of internal objects during HTTP/2 processing of asynchronous servlets. A processing error can lead to requests or responses being inadvertently mixed between different users. This can result in sensitive information crossing user boundaries. Affected versions include 11.0.22 through 11.0.26, 10.1.55 through 10.1.60, and 9.0.118 through 9.0.122.

Other Notable Vulnerabilities

CVE-2026-103119 affects AJP response handling in Tomcat 11.0.0-M25 through 11.0.26. This vulnerability involves a buffer under-read during large non-blocking writes, potentially causing a response body to be split between the current request and a subsequent request on the same connection. Apache indicates that this is likely to result in the failure of the second request, with a potential for data leakage from the first response.

Similarly, CVE-2026-88041, rated “Low,” describes a scenario where HTTP/2 trailer information from an earlier request might leak into a later one due to incomplete cleanup processes.

Other identified flaws include:

• CVE-2026-93446 (Low): A cleanup issue that can lead to intermittent TLS 1.3 connection failures.
• CVE-2026-74049 (Low): Affects Jasper’s JSTL <c: redirect> plug-in, where page code can continue to execute after a redirect, contrary to expectations.
• CVE-2026-74048 (Low): Impacts OpenSSL-FFM configurations utilizing FIPS mode. If FIPS activation fails, Tomcat logs an error but continues startup in non-FIPS mode instead of halting, potentially bypassing security controls.
• CVE-2026-80353 (Low): A race condition in Tomcat 9’s APR connector during Unix Domain Socket creation, which could grant unauthorized local users access. Apache has clarified that Apache says the earlier fix for CVE-2026-65183 did not cover this specific connector. Versions 9.0.47 through 9.0.122 are affected.

While Apache has not reported active exploitation of these vulnerabilities, the severity of the authentication bypass and cross-user data leakage risks underscores the urgency for prompt patching, especially where the affected features are in active use.

What You Should Do

• Identify Affected Deployments: Determine which of your Apache Tomcat installations are running versions susceptible to these vulnerabilities. Refer to Apache’s official security advisories for Tomcat 11 and Tomcat 9 for detailed affected ranges and patch specifics.
• Upgrade Immediately: Apply the latest patched versions (Tomcat 11.0.27, 10.1.61, and 9.0.123) or newer for your respective Tomcat branches.
• Review Configurations: Pay close attention to your JNDIRealm and HTTP/2 configurations. For CVE-2026-101296, verify your non-GSSAPI SASL authentication mechanisms.
• Monitor Apache Advisories: Stay informed by regularly checking Apache’s official security announcements for any new vulnerabilities or updates.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.