Apache Tomcat Security Flaws Allow Attackers to Bypass Authentication and Expose User Data
Apache Tomcat Security Flaws Allow Attackers to Bypass Authentication and Expose User Data
Apache disclosed eight vulnerabilities in Tomcat, including authentication bypass , cross-user data exposure, insecure socket access, and cryptographic configuration failures. Of these, three are rated Important, and five are rated Low. Fixes are available in Tomcat versions 11.0.27, 10.1.61, and 9.0.123, depending on the affected version branch. These vulnerabilities affect specific components…
Vulnerabilities mentionedAll →
- CVE-2026-1012969.1—A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication…published
- CVE-2026-1013569.1—Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response…published
Full article498 words · extracted from gbhackers.com · click to collapse
Apache disclosed eight vulnerabilities in Tomcat, including authentication bypass, cross-user data exposure, insecure socket access, and cryptographic configuration failures.
Of these, three are rated Important, and five are rated Low. Fixes are available in Tomcat versions 11.0.27, 10.1.61, and 9.0.123, depending on the affected version branch.
These vulnerabilities affect specific components and configurations, not every deployment equally. Administrators should evaluate JNDIRealm authentication, AJP connections, HTTP/2 processing, Unix domain sockets, Jasper redirects, and FIPS settings to assess potential exposure.
Apache Tomcat Security Flaws
CVE-2026-101296: This vulnerability allows attackers to authenticate without providing the correct password when JNDIRealm is using a non-GSSAPI SASL authentication mechanism. The missing validation step makes the vulnerability affect all three affected Tomcat branches.
CVE-2026-103119: This flaw affects the AJP connector in Tomcat 11. A buffer under-read during large non-blocking writes can split a response body between consecutive requests on the same connection, likely causing the second request to fail. However, it could also expose information from the first response.
CVE-2026-101356: This vulnerability involves incorrect object recycling during HTTP/2 asynchronous servlet processing after an error occurs. Reused objects can mix requests or responses between users, creating a potential cross-user disclosure path.
Complete Vulnerability Table
The following table summarizes the affected version ranges and the corresponding fixed versions for each vulnerability:
| CVE | Severity | Vulnerability | Affected versions | Fixed versions |
|---|---|---|---|---|
| CVE-2026-103119 | Important | AJP response mix-up | 11.0.0-M25–11.0.26 | 11.0.27 |
| CVE-2026-101356 | Important | HTTP/2 asynchronous request/response mix-up | 11.0.22–11.0.26; 10.1.55–10.1.60; 9.0.118–9.0.122 | 11.0.27; 10.1.61; 9.0.123 |
| CVE-2026-101296 | Important | JNDIRealm authentication bypass | 11.0.0-M1–11.0.26; 10.1.0-M1–10.1.60; 9.0.0.M1–9.0.122 | 11.0.27; 10.1.61; 9.0.123 |
| CVE-2026-93446 | Low | TLS 1.3 connection failures | 11.0.0-M21–11.0.26; 10.1.25–10.1.60; 9.0.90–9.0.122 | 11.0.27; 10.1.61; 9.0.123 |
| CVE-2026-88041 | Low | HTTP/2 trailer cross-contamination | 11.0.0-M23–11.0.26; 10.1.27–10.1.60; 9.0.92–9.0.122 | 11.0.27; 10.1.61; 9.0.123 |
| CVE-2026-80353 | Low | APR/Native Unix socket permission race | 9.0.47–9.0.122 | 9.0.123 |
| CVE-2026-74049 | Low | Jasper redirect fails to stop page processing | 11.0.0-M1–11.0.26; 10.1.0-M1–10.1.60; 9.0.0.M1–9.0.122 | 11.0.27; 10.1.61; 9.0.123 |
| CVE-2026-74048 | Low | Failed FIPS activation permits non-FIPS startup | 11.0.0-M14–11.0.26; 10.1.22–10.1.60; 9.0.92–9.0.122 | 11.0.27; 10.1.61; 9.0.123 |
CVE-2026-80353 is a time-of-check to time-of-use (TOCTOU) race affecting Unix domain socket creation through the APR/Native connector. An unauthorized local user could potentially access the socket. The previous fix for CVE-2026-65183 addressed the NIO connector but overlooked this corresponding APR/Native issue.
CVE-2026-74049 affects the Jasper JSTL `<c:redirect>` plug-in replacement. The absence of page-abort behavior allows processing to continue after a redirect instead of terminating immediately.
CVE-2026-74048 relates to OpenSSL-FFM FIPS handling. When FIPS activation fails, Tomcat logs an error. However, he continues to use JSSE in non-FIPS mode, contrary to the desired configuration.
The remaining flaws are linked to incomplete cleanup, CVE-2026-93446 causes intermittent TLS 1.3 connection failures, while CVE-2026-88041 allows HTTP/2 trailer information to carry over into subsequent requests.
Apache advises upgrading to the fixed release for each affected branch. After the update, pay particular attention to validating authentication, response isolation, socket permissions, redirection behavior, and FIPS compliance.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.