APACHE disclosed eight vulnerabilities in Tomcat on 20 October 2026. Three are rated Important by the project, including CVE-2026-101296, an authentication bypass affecting JNDI realms that use a non-GSSAPI SASL mechanism: an attacker may be able to log in without the correct password. It affects sites using LDAP login through that realm. CVE-2026-101356 can cause HTTP/2 requests or responses to be mixed up between users.
CVE-2026-103119 affects Tomcat 11’s AJP connector: a large non-blocking write can split a response across requests, potentially exposing data from one response to another user. The two response-mix-up flaws are rated Important by Apache and scored 9.1 under CVSSv4 by CISA.
The other five issues include a Unix domain socket access race, a failure to remain in FIPS mode when start-up fails, a Jasper JSTL redirect that does not halt page execution, HTTP/2 trailer leaks and intermittent TLS 1.3 failures. The affected releases include Tomcat 11 through 11.0.26, 10.1 through 10.1.60 and 9 through 9.0.122, though ranges vary by flaw. Tomcat 8.5 and 7.0 are also affected by two flaws but are end-of-life and will not receive fixes.
The article reports no confirmed exploitation in the wild or public proof of concept. Apache’s fixed releases are 11.0.27, 10.1.61 and 9.0.123. Administrators should upgrade; those on unsupported versions should move to a supported release. The article also advises reviewing SASL JNDI realm settings, disabling unused AJP connectors and checking regulated servers for unexpected FIPS start-up errors.