FHN 
Organizations running Apache Tomcat should review their server security following a new batch of vulnerability fixes. The issues affect several areas of the software, including login verification, web request processing, and communication between applications.
Some of these weaknesses could expose information belonging to different users or allow unauthorized access under specific configurations. Others may cause connection problems or weaken security settings.
Apache published the fixes on October 20, 2026. The corrected releases are Tomcat 11.0.27, 10.1.61, and 9.0.123.
Which Security Risks Matter Most?
Three vulnerabilities have been rated Important by Apache. Their potential impact makes them a priority for administrators managing affected servers.
Authentication checks may be bypassed
CVE-2026-101296 affects a particular configuration of Tomcat’s JNDIRealm component. Under certain SASL authentication settings, the software may fail to verify a password correctly, potentially allowing unauthorized access.
This is a configuration-dependent issue rather than a universal weakness affecting every Tomcat login system.
Information could cross user boundaries
CVE-2026-101356 involves the handling of HTTP/2 requests when asynchronous processing encounters an error. Under affected conditions, internal data may be reused incorrectly, potentially causing one user’s request or response to become mixed with another’s.
CVE-2026-103119 presents a related concern in the AJP connector, where response data can interfere with a subsequent request on the same connection.
CVE-2026-88041 also involves HTTP/2 processing. Incomplete cleanup may allow trailer information from a previous request to carry over into another request.
Together, these issues highlight the importance of correctly separating information processed for different users.
Five Additional Flaws Addressed
The remaining vulnerabilities affect other Tomcat functions and have been classified as Low severity.
- CVE-2026-93446: A cleanup problem that can cause some TLS 1.3 connections to fail intermittently.
- CVE-2026-74049: A redirect-handling issue in Jasper that can allow additional page code to run after a redirect.
- CVE-2026-74048: A FIPS configuration problem that may leave Tomcat running without successfully enabling the intended FIPS mode.
- CVE-2026-80353: A race condition involving Unix Domain Socket creation in the Tomcat 9 APR connector, potentially exposing the socket to an unauthorized local user.
The affected release ranges differ for each issue. Administrators should not assume that upgrading one product branch or changing one setting resolves every vulnerability.
What Tomcat Administrators Should Do
Security teams should begin by identifying which Tomcat versions are running across their environments. This includes production servers, internal applications, and systems maintained by separate development teams.
The following steps can help reduce exposure:
- Update affected installations. Move to the appropriate fixed release: 11.0.27, 10.1.61, or 9.0.123.
- Review authentication configurations. Pay particular attention to JNDIRealm and the SASL mechanisms in use.
- Check enabled connectors. Determine whether HTTP/2, AJP, and APR-related components are enabled and exposed.
- Validate security settings. Confirm that systems requiring FIPS mode do not continue operating in an unintended configuration.
- Test after patching. Verify authentication, application responses, TLS connections, and critical services after applying updates.
Apache’s published advisories provide the authoritative affected-version details and upgrade guidance. The notices do not establish that these eight vulnerabilities are being actively exploited.
Final Takeaway
A web server can introduce security risks through more than just its login page. Incorrect request handling, incomplete cleanup, and configuration failures can also affect confidentiality and availability.
Organizations using Apache Tomcat should verify their exposure and install the appropriate fixes promptly, particularly where authentication bypass or cross-user data exposure may be possible.
About the Author
