Apache Tomcat flaws allow auth bypass and data exposure
Eight issues span three branches; Important fixes are in Tomcat 11.0.27, 10.1.61 and 9.0.123, with no exploitation stated.
4
Stories per day · 30 days
Relatedapache-tomcat3authentication-bypass2http22buffer-under-read1information-disclosure1jndi1jndirealm1
6 stories, newest first · one card per story
Stories tagged #ajp
Apache Tomcat patches eight flaws, including a password bypass
Fixes shipped in 11.0.27, 10.1.61 and 9.0.123; three issues are Important and no active exploitation is reported.
6
Apache Tomcat AJP under-read can mix responses (CVE-2026-103119)
Tomcat 11.0.0-M25 through 11.0.26 can send part of one response body to the next request on the same connection.
Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security
Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.
CVE-2026-78383: Apache Tomcat: AJP DoS via missing request body
Unauthenticated AJP requests can pin Apache Tomcat threads and cause denial of service.