Apache has issued patches for its Tomcat application server to address eight newly discovered vulnerabilities that span multiple version branches and pose risks from authentication bypass to cross-user data exposure. The fixes were rolled out in Tomcat versions 11.0.27, 10.1.61, and 9.0.123 on October 20, 2026, sealing loopholes in branching releases where versions vary in which issues apply.
Key Vulnerabilities and Affected Features
Of the eight flaws, three are classified by Apache as “Important,” while the other five are “Low” in severity. The most severe issues involve:
- Authentication bypass in the JNDIRealm component when using non-GSSAPI SASL mechanisms. This allows attackers to authenticate without the correct password in vulnerable versions up to 11.0.26, 10.1.60, and 9.0.122.
- Mix-ups in HTTP/2 processing of asynchronous servlets, leading to request or response data confusion between users on impacted versions.
- Buffer under-read in AJP response handling during large non-blocking writes, which may split response content across requests and leak data.
The additional, lower-severity flaws include:
- HTTP/2 trailer information from one request leaking into a later request because of incomplete cleanup.
- TLS 1.3 connection failures due to a cleanup problem.
- A flaw in Jasper’s JSTL
- Failure of FIPS mode activation in OpenSSL-FFM configurations: instead of halting startup on failure, Tomcat continues with JSSE in non-FIPS mode.
- A race condition in the APR connector when creating Unix Domain Sockets in Tomcat 9, allowing unauthorized local users access. Earlier fixes did not cover this connector.
What Organizations Should Do Now
Administrators running any of the impacted Tomcat versions should upgrade immediately to the patched branches (11.0.27, 10.1.61, or 9.0.123). Careful auditing of configuration—especially authentication settings, enabled components like HTTP/2 or AJP, and SSL/TLS/FIPS deployment—is essential to determine exposure. The vulnerability ranges are specific: not every flaw affects every version or setup.
No evidence of active exploitation has been reported yet. Nonetheless, the presence of a password bypass and data leaks makes swift patching especially important for any deployment using the features involved. Previous access-control vulnerabilities don’t mitigate for these new issues; this is a fresh wave of bugs.
Tomcat 11 security advisories and Tomcat 9 notices include detailed descriptions, affected version ranges, and patching instructions. Monitoring those is critical to ensure defenses remain current.
This matters because Tomcat is a foundational component in many enterprise Java infrastructures. Vulnerabilities that allow authentication bypass or cross-user leakage strike at the heart of application security—and misconfigurations make even “low” severity issues potentially serious. Going forward, organizations should pay close attention not just to version numbers but to which modules and features are active in their deployments, and maintain disciplined patch-management practices to guard against similar cascading risks.
