Apache discloses eight Tomcat flaws; three rated important
First merged summary.
On October 20 Apache disclosed eight Tomcat vulnerabilities; three are rated important, and the notices name no fixes.
Mark Thomas posted eight Apache Tomcat security notices to oss-security on October 20, 2026. Three are rated important: CVE-2026-101296, a JNDIRealm bind-credential check that fails open for non-GSSAPI SASL; CVE-2026-101356, an HTTP/2 request or response mix-up during async servlet errors; and CVE-2026-103119, an AJP response-body mix-up on Tomcat 11.0.0-M25 through 11.0.26. Five others are rated low, including FIPS activation that fails open, a Jasper SKIP_PAGE omission, an APR Unix-socket TOCTOU, HTTP/2 trailer leakage, and intermittent TLS 1.3 failures. Affected ranges span Tomcat 7 through 11 depending on the flaw. None of the posted notices names a fixed release or reports exploitation.
- Important: CVE-2026-101296 affects Tomcat 7.0 through 11.0.26.
- Important: CVE-2026-101356 affects 11.0.22–11.0.26, 10.1.55–10.1.60, and 9.0.118–9.0.122.
- Important: CVE-2026-103119 affects only 11.0.0-M25 through 11.0.26.
- CVE-2026-80353 lets an unauthorised local user reach the APR Unix socket.
- The earlier NIO fix for CVE-2026-65183 did not cover APR.
- None of the posted notices names a fixed release.
Timeline
dated events in the reporting · oldest first- Oct 20, 2026Mark Thomas posted eight Apache Tomcat CVE notices. · oss-security
What each outlet adds
beyond the shared facts- oss-securityLists eight CVEs, affected ranges, and low or important ratings.
- CVEs
- CVE-2026-101356CVE-2026-101296CVE-2026-103119CVE-2026-88041CVE-2026-80353CVE-2026-74049CVE-2026-74048CVE-2026-93446
- Vendors
- Apache
- Products
- Apache TomcatTomcat
Coverage
oldest first · one row per article · UTC- · 10d ago
oss-securityFirst report
Tomcat keeps starting if OpenSSL FIPS activation fails (CVE-2026-74048)
With OpenSSLLifecycleListener in FIPS mode, a failed activation leaves Tomcat on non-FIPS JSSE; severity is low.
- · 10d ago
Tomcat Jasper JSTL omits page abort after redirect (CVE-2026-74049)
Mark Thomas rated the execution-after-redirect flaw low across listed Tomcat 7 through 11 builds; the excerpt names no fix.
- · 10d ago
Tomcat APR sockets still exposed by TOCTOU after earlier fix
An unauthorised local user can reach the APR/Native Unix domain socket on Tomcat 9.0.47 through 9.0.122.
- · 10d ago
Tomcat HTTP/2 trailer headers can leak into the next request
Apache rates the incomplete cleanup low; fixed releases are not named in the posted notice.
- · 10d ago
Apache Tomcat incomplete cleanup can drop TLS 1.3 connections
Apache rates CVE-2026-93446 low; affected 9, 10.1, and 11 lines can fail TLS 1.3 intermittently.
- · 10d ago
Tomcat JNDIRealm auth fails open for non-GSSAPI SASL (CVE-2026-101296)
Apache rates the flaw important across Tomcat 7 through 11 ranges when JNDIRealm uses non-GSSAPI SASL.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-101296+2 related CVEs | Auth bypass in Apache Tomcat JNDIRealm with non-GSSAPI SASL | 9.1 | — | ||
| CVE-2026-74048 | Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat | 6.5 | — | ||
| CVE-2026-74049 | Execution After Redirect (EAR) vulnerability in Apache Tomcat | 6.1 | — | ||
| CVE-2026-80353 | Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an… | 8.1 | — | ||
| CVE-2026-88041 | Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request | 7.5 | — | ||
| CVE-2026-93446 | Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently | 7.5 | — |