Apache Tomcat fixes nine CVEs in 9.0.123, 10.1.61 and 11.0.27, including JNDIRealm authentication bypass and HTTP/2 data mixing
Apache released fixes on 12 October 2026 for multiple vulnerabilities in Apache Tomcat. The fixed versions are 9.0.123, 10.1.61 and 11.0.27. CERT-FR advisory CERTFR-2026-AVI-1358 lists nine CVEs and says an attacker could breach confidentiality, bypass the security policy or trigger an unspecified security issue (cert.ssi.gouv.fr). Covera…