Apache Tomcat Fixes Eight Flaws, Including JNDIRealm Authentication Bypass and Response Mix-Ups

TL;DR

On October 20, 2026, the Apache Software Foundation disclosed eight Apache Tomcat vulnerabilities. Three rate Important, including a JNDIRealm authentication bypass and two flaws that can mix up responses between users. Tomcat 11.0.27, 10.1.61 and 9.0.123 fix them.

Notable CVEs

Why It Matters

Tomcat runs a large share of Java web applications, from internal portals to public APIs. Response mix-ups can hand one user’s data to another. Meanwhile, the authentication bypass reaches back to Tomcat 7, so many older systems remain exposed.

The fixes also arrive just one month after Tomcat 9.0.122 patched 12 other flaws. As a result, admins who skipped September’s update now face two rounds of fixes at once.

How Apache rated them

According to the Tomcat security pages, Apache rates three flaws Important and four Low. CVE-2026-80353 has no published rating yet. Researchers reported the issues privately between August 13 and September 16, 2026.

How the Attacks Work

Important-rated flaws

• CVE-2026-101296: when the JNDI realm uses a non-GSSAPI SASL mechanism, attackers can “authenticate without providing the correct password.” Apache titles it a bind credential check that “fails open.” Only sites that use LDAP login through that realm are exposed.
• CVE-2026-101356 (CVSS 9.1): faulty object reuse in HTTP/2 async processing “can trigger request and/or response mix-up between users.”
• CVE-2026-103119 (CVSS 9.1): an AJP response mix-up in Tomcat 11. A large non-blocking write can split one response across two requests. That may leak “data from the first response to the second.”

The 9.1 scores come from CISA’s assessment. Apache itself rates both flaws Important.

Other fixes

• CVE-2026-80353: a race condition lets a local user reach Unix domain sockets on the APR/Native connector. It completes an earlier, partial fix.
• CVE-2026-74048: if FIPS mode fails to start, Tomcat keeps running in non-FIPS mode. That matters for regulated sites that must use certified cryptography.
• CVE-2026-74049: a Jasper JSTL redirect does not stop page execution.
• CVE-2026-88041 and CVE-2026-93446: HTTP/2 trailer leaks and intermittent TLS 1.3 failures.

Exploitation status

No exploitation in the wild or public PoC has been confirmed for these Apache Tomcat vulnerabilities. CISA lists exploitation as “none” for the two scored flaws.

Affected Versions

• Tomcat 11: through 11.0.26
• Tomcat 10.1: through 10.1.60
• Tomcat 9: through 9.0.122
• End-of-life 8.5 and 7.0: affected by CVE-2026-101296 and CVE-2026-74049, with no fix

Exact ranges differ by flaw. For example, CVE-2026-103119 affects only Tomcat 11, and CVE-2026-80353 affects only Tomcat 9.

Patch and Mitigation Steps

• Upgrade to Tomcat 11.0.27, Tomcat 10.1.61 or Tomcat 9.0.123.
• Move off Tomcat 8.5 and 7.0, which will not receive fixes.
• Review JNDI realm settings if you use SASL authentication.
• Disable the AJP connector if you do not need it.
• Check logs for unexpected FIPS start-up errors on regulated servers.

Given the authentication bypass and two critical-scored mix-ups, teams should patch these Apache Tomcat vulnerabilities in their next maintenance window, or sooner for internet-facing servers.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.