Apache Tomcat Fixes 8 Security Flaws That Could Let Hackers Bypass Authentication

Apache Tomcat has fixed eight security flaws that could let attackers bypass password checks, expose data between users, and disrupt connections under specific conditions.

Apache disclosed the vulnerabilities on October 20, 2026, after releasing fixes in Tomcat 11.0.27, 10.1.61, and 9.0.123. The eight issues span different release branches, so not every flaw affects every version.

Apache rates three flaws as Important and five as Low. The most serious problems involve authentication, HTTP/2 request handling, and AJP response processing. Their impact depends on the Tomcat version and the features enabled, making configuration checks an important part of assessing exposure.

CVE-2026-101296 affects JNDIRealm when configured with a non-GSSAPI SASL authentication mechanism. A missing validation step lets attackers authenticate without supplying the correct password.

The flaw affects Tomcat 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122. It is not a universal login bypass across all Tomcat installations.

Apache Tomcat Fixes 8 Security Flaws

The issue differs from the earlier GSSAPI-related JNDIRealm bypass covered in Cyber Security News’ report on Apache Tomcat authentication vulnerabilities.

The latest advisory concerns other SASL mechanisms, so administrators should check the actual authentication settings rather than rely on the component name alone.

CVE-2026-101356 involves incorrect recycling and reuse of internal objects during HTTP/2 processing of asynchronous servlets. Following a processing error, requests or responses can become mixed between users.

Affected releases include 11.0.22 through 11.0.26, 10.1.55 through 10.1.60, and 9.0.118 through 9.0.122. This creates a risk that information crosses user boundaries.

CVE-2026-103119 affects AJP response handling in Tomcat 11.0.0-M25 through 11.0.26. A buffer under-read during a large non-blocking write can split a response body between the current request and the next request on the same connection.

Apache says the likely result is failure of the second request, with possible leakage from the first response. CVE-2026-88041 allows HTTP/2 trailer information from an earlier request to leak into a later request because cleanup is incomplete.

CVE ID	Vulnerability	Severity
CVE-2026-101296	JNDIRealm authentication bypass	Important
CVE-2026-101356	HTTP/2 request/response mix-up	Important
CVE-2026-103119	AJP response mix-up	Important
CVE-2026-88041	HTTP/2 trailer leakage	Low
CVE-2026-93446	TLS 1.3 connection failure	Low
CVE-2026-74049	Jasper redirect flaw	Low
CVE-2026-74048	FIPS activation failure	Low
CVE-2026-80353	APR socket permissions race	Low

Another cleanup flaw, CVE-2026-93446, can cause intermittent TLS 1.3 connection failures. Apache rates both issues Low, separating them from the more serious cross-user request and response mix-up.

CVE-2026-74049 affects Jasper’s JSTL <c: redirect> plug-in. Processing does not stop immediately after a redirect, allowing the remaining page code to run.

CVE-2026-74048 affects OpenSSL-FFM configurations using FIPS mode. If FIPS activation fails, Tomcat logs an error but continues with JSSE in non-FIPS mode instead of stopping startup.

The eighth flaw, CVE-2026-80353, concerns Tomcat 9’s APR connector. A race condition when creating a Unix Domain Socket can give an unauthorized local user access. Apache says the earlier fix for CVE-2026-65183 did not cover this connector. Versions 9.0.47 through 9.0.122 are affected.

Administrators should upgrade affected deployments to the fixed release for their branch. Apache’s Tomcat 11 security advisory and Tomcat 9 advisory provide affected ranges and patch details.

Earlier Tomcat access-control flaws offer useful background, but their older patched versions do not resolve this new batch. Apache’s notices do not report active exploitation. However, the password bypass and cross-user data risks warrant prompt patching wherever the affected features are in use.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.