Multiple security vulnerabilities have been identified in Apache Tomcat, affecting authentication, request handling, response separation, and protocol processing across Tomcat 11 through 11.0.26, Tomcat 10.1 through 10.1.60, Tomcat 9 through 9.0.122, and certain end-of-life 8.5 and 7.0 releases. The flaws can allow unauthenticated access, cross-user response leakage, local access to restricted sockets, and protocol or security-mode failures. No confirmed exploitation has been reported, but the combination of high-severity issues and broad deployment makes the risk significant.
CVE-2026-101296: A JNDIRealm authentication flaw involving non-GSSAPI SASL mechanisms could allow attackers to authenticate without supplying the correct password when the affected configuration is used.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Apache Tomcat, affecting authentication, request handling, response separation, and protocol processing across Tomcat 11 through 11.0.26, Tomcat 10.1 through 10.1.60, Tomcat 9 through 9.0.122, and certain end-of-life 8.5 and 7.0 releases. The flaws can allow unauthenticated access, cross-user response leakage, local access to restricted sockets, and protocol or security-mode failures. No confirmed exploitation has been reported, but the combination of high-severity issues and broad deployment makes the risk significant.
CVE-2026-101296: A JNDIRealm authentication flaw involving non-GSSAPI SASL mechanisms could allow attackers to authenticate without supplying the correct password when the affected configuration is used.[emaillocker id="1283"]
CVE-2026-101356: Incorrect object recycling during asynchronous HTTP/2 processing could cause requests or responses to be mixed between users, potentially exposing sensitive response data.
CVE-2026-103119: A buffer under-read in the AJP connector could split response data between requests on the same connection, potentially leaking information from one response to another.
CVE-2026-93446: Incomplete cleanup could cause intermittent failures of TLS 1.3 connections.
CVE-2026-88041: Inadequate cleanup of HTTP/2 trailer headers could allow header information from one request to leak into a subsequent request.
CVE-2026-80353: A time-of-check-to-time-of-use race condition when setting Unix domain socket permissions could allow an unauthorized local user to access the socket.
CVE-2026-74049: The Jasper JSTL <c:redirect> implementation did not immediately terminate page processing after a redirect, allowing subsequent page content to be processed.
CVE-2026-74048: If FIPS activation failed when configured through the OpenSSL-FFM lifecycle listener, Tomcat could continue starting with JSSE in non-FIPS mode instead of preventing startup.
These vulnerabilities collectively present a significant risk to internet-facing and internally deployed Java web applications, especially where authentication realms, HTTP/2, AJP, or regulated cryptographic modes are used. Organizations with exposed or legacy deployments are most at risk and should prioritize assessment and appropriate response.
The following reports contain further technical details:
[/emaillocker]