Apache Tomcat fixes a JNDIRealm password bypass and HTTP/2 mix-up

Apache Tomcat fixes a JNDIRealm password bypass and HTTP/2 mix-up

20 October 2026: The Apache Tomcat project has disclosed CVE-2026-101296, a flaw rated Important that let attackers log in without the correct password when the JNDI realm uses a SASL mechanism other than GSSAPI, together with an HTTP/2 bug that can swap requests and responses between users. Both are fixed in Tomcat 11.0.27, 10.1.61 and 9.0.123, released on 12 October; the details were made public on 20 October and the project reports no exploitation.

Fixed versions

• Tomcat 11: 11.0.27
• Tomcat 10.1: 10.1.61
• Tomcat 9: 9.0.123

The three Important flaws

CVE	What goes wrong	Affected
CVE-2026-101296	JNDIRealm bind credential check fails open for non-GSSAPI SASL mechanisms	11.0.0-M1 to 11.0.26, 10.1.0-M1 to 10.1.60, 9.0.0.M1 to 9.0.122
CVE-2026-101356	Object recycling in HTTP/2 asynchronous servlets mixes up requests and responses after an error	11.0.22 to 11.0.26, 10.1.55 to 10.1.60, 9.0.118 to 9.0.122
CVE-2026-103119	AJP buffer under-read can split a response body into the next request on the connection	11.0.0-M25 to 11.0.26

The JNDIRealm bug reaches back to the first milestone of every supported line, so almost any Tomcat that checks passwords against an LDAP directory through JNDIRealm and uses a SASL mechanism such as DIGEST-MD5 is exposed. Realms configured with GSSAPI (Kerberos), or with simple binds, are not covered by the description. The HTTP/2 mix-up only reaches recent releases, from 11.0.22, 10.1.55 and 9.0.118 on, and needs asynchronous servlets over HTTP/2. The AJP flaw matters where Tomcat sits behind Apache httpd or another proxy talking AJP, and the project says the likely result is a failed second request, with leakage from the first response possible.

All three were reported to the Tomcat security team in mid-September. Italy's national cyber agency, ACN, published a bulletin on 21 October that labels them critical and gives a systemic impact score of 66.41; the project's own rating is Important.

Lower-rated fixes in the same releases

The releases also close several Low issues: intermittent TLS 1.3 connection failures (CVE-2026-93446), HTTP/2 trailer headers leaking from one request into the next (CVE-2026-88041), a Jasper JSTL redirect that keeps processing the rest of the page (CVE-2026-74049) and, in Tomcat 11, an OpenSSL FIPS failure that does not stop start-up (CVE-2026-74048).

Finding the Tomcats you did not know you ran

Tomcat is bundled inside a long list of commercial products, from monitoring consoles to document management systems, and those vendors ship the fix on their own timetable. The quickest check on a server is the version string in lib/catalina.jar, or bin/version.sh on Linux; for appliances, the vendor's own advisory is the only reliable answer. Since the password bypass needs a non-GSSAPI SASL mechanism on the realm, the realm's configuration in server.xml shows at a glance whether a given server is in scope.

Related on TrustList:

• Apache fixes four Struts flaws, one of them OGNL code execution
• Oracle's October update brings 1,295 patches and a 9.8 E-Business Suite flaw
• IBM lists five WebSphere Liberty flaws fixed in 26.0.0.10

Sources

• Apache Tomcat 11.x vulnerabilities, 20 October 2026
• Apache Tomcat 10.x vulnerabilities, 20 October 2026
• Apache Tomcat 9.x vulnerabilities, 20 October 2026
• ACN (Italy): Risolte vulnerabilità in Apache Tomcat, 21 October 2026