Apache Tomcat Addresses Eight Security Vulnerabilities, Including Critical Authentication Bypass Flaws
Apache Tomcat has released patches for eight security vulnerabilities affecting its 11.0.x, 10.1.x, and 9.0.x branches, with three critical flaws enabling authentication bypass and cross-user data exposure.
Apache Tomcat has released critical patches for eight security vulnerabilities that could allow attackers to bypass authentication, expose sensitive data between users, and disrupt network connections. The fixes are available in Tomcat versions 11.0.27, 10.1.61, and 9.0.123, addressing issues across different release branches.
Three of the vulnerabilities have been rated as 'Important' due to their potential impact. CVE-2026-101296 specifically targets the JNDIRealm component when configured with non-GSSAPI SASL authentication mechanisms. A missing validation step in this configuration allows attackers to authenticate without providing the correct credentials. This flaw affects a wide range of Tomcat versions, including 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122. It is important to note that this is not a universal bypass for all Tomcat installations but is specific to certain authentication configurations.
Another significant vulnerability, CVE-2026-101356, arises from the incorrect recycling and reuse of internal objects during the processing of asynchronous servlets via HTTP/2. This can lead to requests or responses being mixed between different users, potentially exposing data across user sessions. This issue impacts Tomcat versions 11.0.22 through 11.0.26, 10.1.55 through 10.1.60, and 9.0.118 through 9.0.122.
CVE-2026-103119 affects the AJP (Apache JServ Protocol) response handling in Tomcat versions 11.0.0-M25 through 11.0.26. A buffer under-read vulnerability during large non-blocking writes can cause a response body to be split between the current request and the subsequent request on the same connection. Apache indicates that this could result in the failure of the second request and potential leakage of data from the first response.
Five lower-severity vulnerabilities have also been addressed. CVE-2026-88041 involves an HTTP/2 trailer leakage issue due to incomplete cleanup, where information from an earlier request could inadvertently appear in a later request. CVE-2026-93446 can cause intermittent TLS 1.3 connection failures due to incomplete cleanup. CVE-2026-74049 affects Jasper's JSTL <c: redirect> plug-in, allowing remaining page code to execute after a redirect. CVE-2026-74048 addresses an issue where Tomcat might continue startup in non-FIPS mode instead of stopping if FIPS activation fails in OpenSSL-FFM configurations. Finally, CVE-2026-80353, affecting Tomcat 9's APR connector, involves a race condition during Unix Domain Socket creation that could grant unauthorized local user access.
Administrators are strongly advised to upgrade their affected Tomcat deployments to the latest fixed versions. Apache's security advisories for Tomcat 11 and Tomcat 9 provide detailed information on affected version ranges and specific patch details. While Apache has not reported active exploitation of these vulnerabilities, the potential for authentication bypass and cross-user data exposure necessitates prompt patching for all environments utilizing the affected features.
These patches are crucial for maintaining the security posture of applications relying on Apache Tomcat, a widely used web server. The vulnerabilities highlight the ongoing need for diligent security practices, including regular updates and configuration reviews, to protect against potential exploitation.