Apache Tomcat patches 8 flaws, including critical ones
Updates to 9.0.123, 10.1.61 and 11.0.27 fix HTTP/2 and JNDIRealm issues; the 9.0 line loses support in March 2027.
The Apache Software Foundation has disclosed eight vulnerabilities affecting Apache Tomcat versions 9, 10 and 11, including issues rated CRITICAL with a maximum CVSS 3.1 score of 9.1, according to forest.watch.impress.co.jp. The flaws are fixed by updating to Apache Tomcat 9.0.123, 10.1.61 or 11.0.27.
Among the most serious is CVE-2026-101356, an HTTP/2 request/response mix-up that occurs after an error during async processing. It affects Tomcat 11.0.22 through 11.0.26, 10.1.55 through 10.1.60, and 9.0.118 through 9.0.122.
A second flaw, CVE-2026-101296, involves JNDIRealm bind credential validation failing open for non-GSSAPI SASL mechanisms. That issue covers a much longer range: Tomcat 11.0.0-M1 to 11.0.26, 10.1.0-M1 to 10.1.60, and 9.0.0.M1 to 9.0.122.
CVE-2026-103119, an AJP response mix-up, is limited to the 11.0 branch, affecting Tomcat 11.0.0-M25 to 11.0.26 only.
Support timeline
The fixed builds were released on October 12, 2026. Operators still running the 9.0 line should note that Apache Tomcat 9.0 reaches end of support on March 31, 2027.
Quick answers
Which Apache Tomcat versions fix the disclosed vulnerabilities?
Apache Tomcat 9.0.123, 10.1.61 and 11.0.27.
What is the highest severity rating among the flaws?
Some issues are rated CRITICAL with a maximum CVSS 3.1 score of 9.1.
When does Apache Tomcat 9.0 reach end of support?
On March 31, 2027.