Apache Tomcat Security Flaws Allow Attackers to Bypass Authentication and Expose User Data

Apache disclosed eight vulnerabilities in Tomcat, including authentication bypass, cross-user data exposure, insecure socket access, and cryptographic configuration failures.

Of these, three are rated Important, and five are rated Low. Fixes are available in Tomcat versions 11.0.27, 10.1.61, and 9.0.123, depending on the affected version branch.

These vulnerabilities affect specific components and configurations, not every deployment equally. Administrators should evaluate JNDIRealm authentication, AJP connections, HTTP/2 processing, Unix domain sockets, Jasper redirects, and FIPS settings to assess potential exposure.

Apache Tomcat Security Flaws

CVE-2026-101296: This vulnerability allows attackers to authenticate without providing the correct password when JNDIRealm is using a non-GSSAPI SASL authentication mechanism. The missing validation step makes the vulnerability affect all three affected Tomcat branches.  

CVE-2026-103119: This flaw affects the AJP connector in Tomcat 11. A buffer under-read during large non-blocking writes can split a response body between consecutive requests on the same connection, likely causing the second request to fail. However, it could also expose information from the first response.  

CVE-2026-101356: This vulnerability involves incorrect object recycling during HTTP/2 asynchronous servlet processing after an error occurs. Reused objects can mix requests or responses between users, creating a potential cross-user disclosure path.

Complete Vulnerability Table

The following table summarizes the affected version ranges and the corresponding fixed versions for each vulnerability:

CVE	Severity	Vulnerability	Affected versions	Fixed versions
CVE-2026-103119	Important	AJP response mix-up	11.0.0-M25–11.0.26	11.0.27
CVE-2026-101356	Important	HTTP/2 asynchronous request/response mix-up	11.0.22–11.0.26; 10.1.55–10.1.60; 9.0.118–9.0.122	11.0.27; 10.1.61; 9.0.123
CVE-2026-101296	Important	JNDIRealm authentication bypass	11.0.0-M1–11.0.26; 10.1.0-M1–10.1.60; 9.0.0.M1–9.0.122	11.0.27; 10.1.61; 9.0.123
CVE-2026-93446	Low	TLS 1.3 connection failures	11.0.0-M21–11.0.26; 10.1.25–10.1.60; 9.0.90–9.0.122	11.0.27; 10.1.61; 9.0.123
CVE-2026-88041	Low	HTTP/2 trailer cross-contamination	11.0.0-M23–11.0.26; 10.1.27–10.1.60; 9.0.92–9.0.122	11.0.27; 10.1.61; 9.0.123
CVE-2026-80353	Low	APR/Native Unix socket permission race	9.0.47–9.0.122	9.0.123
CVE-2026-74049	Low	Jasper redirect fails to stop page processing	11.0.0-M1–11.0.26; 10.1.0-M1–10.1.60; 9.0.0.M1–9.0.122	11.0.27; 10.1.61; 9.0.123
CVE-2026-74048	Low	Failed FIPS activation permits non-FIPS startup	11.0.0-M14–11.0.26; 10.1.22–10.1.60; 9.0.92–9.0.122	11.0.27; 10.1.61; 9.0.123

CVE-2026-80353 is a time-of-check to time-of-use (TOCTOU) race affecting Unix domain socket creation through the APR/Native connector. An unauthorized local user could potentially access the socket. The previous fix for CVE-2026-65183 addressed the NIO connector but overlooked this corresponding APR/Native issue.  

CVE-2026-74049 affects the Jasper JSTL `<c:redirect>` plug-in replacement. The absence of page-abort behavior allows processing to continue after a redirect instead of terminating immediately.  

CVE-2026-74048 relates to OpenSSL-FFM FIPS handling. When FIPS activation fails, Tomcat logs an error. However, he continues to use JSSE in non-FIPS mode, contrary to the desired configuration.  

The remaining flaws are linked to incomplete cleanup, CVE-2026-93446 causes intermittent TLS 1.3 connection failures, while CVE-2026-88041 allows HTTP/2 trailer information to carry over into subsequent requests.

Apache advises upgrading to the fixed release for each affected branch. After the update, pay particular attention to validating authentication, response isolation, socket permissions, redirection behavior, and FIPS compliance.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.