/
← Voltar ao feed
medium

Apache Tomcat fixes nine CVEs in 9.0.123, 10.1.61 and 11.0.27, including JNDIRealm authentication bypass and HTTP/2 data mixing

2 fonte(s) · 2 atualização(ões) · publicado 20/10/2026 21:00 · coletado há 13 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 24/10/2026 00:01; os links antigos trazem para cá.

Fontes: cert.ssi.gouv.fr ↗ gbhackers.com ↗

Apache released fixes on 12 October 2026 for multiple vulnerabilities in Apache Tomcat. The fixed versions are 9.0.123, 10.1.61 and 11.0.27. CERT-FR advisory CERTFR-2026-AVI-1358 lists nine CVEs and says an attacker could breach confidentiality, bypass the security policy or trigger an unspecified security issue (cert.ssi.gouv.fr). Coverage on 21 October 2026 describes eight flaws, three rated Important and five rated Low. They include an authentication bypass in JNDIRealm and cross-user data exposure in HTTP/2 (gbhackers.com). Neither source reports active exploitation. Exposure depends on which components and configurations are in use.

Entenda a falha

A vulnerabilidade

Apache Tomcat 9.0.x before 9.0.123, 10.1.x before 10.1.61 and 11.0.x before 11.0.27 have nine CVEs; gbhackers.com details eight and rates three Important and five Low, without saying which three. CVE-2026-101296 in JNDIRealm, with a non-GSSAPI SASL mechanism, lets an attacker authenticate without the correct password; it affects all three branches. CVE-2026-103119 (AJP connector, Tomcat 11) can split a response between consecutive requests and expose data from the first response. CVE-2026-101356 (HTTP/2 async servlets) can mix requests or responses between users. The rest are lower impact: a local Unix socket race in the APR/Native connector (CVE-2026-80353), Jasper c:redirect processing continuing after a redirect (CVE-2026-74049), a silent fallback to non-FIPS JSSE (CVE-2026-74048), and TLS 1.3 failures and HTTP/2 trailer carry-over (CVE-2026-93446, CVE-2026-88041). CVE-2026-65183 is the earlier, incomplete fix. The sources give no CVSS scores or per-CVE prerequisites.

Como funciona

In the JNDIRealm case, a login using a non-GSSAPI SASL mechanism goes through a path where a validation step is missing, so the credential is not properly checked. In the AJP case, a large non-blocking write triggers a buffer under-read, and the response body ends up split across two consecutive requests on the same connection. In HTTP/2, after an error in asynchronous servlet processing, objects are recycled incorrectly and are reused by another request, which can mix data between users. For the Unix socket flaw, a gap between checking and using the socket during creation in the APR/Native connector opens a race for a local user. The articles give no further detail on the other CVEs.

Por que é vulnerável

The causes are mostly missing or incomplete handling. CVE-2026-101296 is a missing validation step in JNDIRealm. CVE-2026-101356, CVE-2026-93446 and CVE-2026-88041 stem from incorrect recycling or incomplete cleanup of state after errors. CVE-2026-80353 is a TOCTOU race that went unnoticed because the earlier fix for CVE-2026-65183 covered only the NIO connector and missed the APR/Native one. CVE-2026-74049 is missing page-abort behavior in the Jasper redirect replacement, and CVE-2026-74048 is a failed FIPS activation that is only logged while Tomcat continues in non-FIPS mode. The articles do not describe the code changes in the fixes.

Onde está

The articles name components rather than files or commits: JNDIRealm, the AJP connector, HTTP/2 async servlet processing, the APR/Native connector, the Jasper JSTL c:redirect plug-in replacement and OpenSSL-FFM FIPS handling; details are in Apache's security bulletins for 9.0.123, 10.1.61 and 11.0.27.

Como foi descoberta

The articles do not say who found these flaws or how they were reported. Apache published the fixes in its security bulletins of 12 October 2026. CERT-FR issued advisory CERTFR-2026-AVI-1358 on 21 October 2026, listing nine CVEs, and gbhackers.com covered eight the same day. One link to earlier work: CVE-2026-80353 exists because the previous fix for CVE-2026-65183 missed the APR/Native connector. Neither source reports exploitation in the wild.

Explicação gerada por IA a partir da matéria e dos artigos, em 24/10/2026 00:16.

Detalhes técnicos

  • Affected versions: Tomcat 9.0.x before 9.0.123, 10.1.x before 10.1.61 and 11.0.x before 11.0.27 (cert.ssi.gouv.fr).
  • CVE-2026-101296: JNDIRealm using a non-GSSAPI SASL mechanism lacks a validation step, so attackers can authenticate without the correct password. It affects all three branches (gbhackers.com).
  • CVE-2026-103119: a buffer under-read in the AJP connector (Tomcat 11) during large non-blocking writes can split a response body between consecutive requests on one connection. The second request likely fails, but information from the first response could be exposed (gbhackers.com).
  • CVE-2026-101356: incorrect object recycling in HTTP/2 asynchronous servlet processing after an error can mix requests or responses between users (gbhackers.com).
  • CVE-2026-80353: a TOCTOU race in Unix domain socket creation via the APR/Native connector could let an unauthorized local user access the socket. The earlier fix for CVE-2026-65183 covered only the NIO connector (gbhackers.com).
  • CVE-2026-74049: the Jasper JSTL <c:redirect> replacement lacks page-abort behavior, so processing continues after a redirect (gbhackers.com).
  • CVE-2026-74048: when OpenSSL-FFM FIPS activation fails, Tomcat logs an error but continues with JSSE in non-FIPS mode (gbhackers.com).
  • CVE-2026-93446 and CVE-2026-88041: incomplete cleanup causes intermittent TLS 1.3 connection failures and carry-over of HTTP/2 trailer information into subsequent requests (gbhackers.com).
  • The CERT-FR advisory gives no per-CVE details, CVSS scores or exploitation data (cert.ssi.gouv.fr).

Remediação

  • Upgrade to 9.0.123, 10.1.61 or 11.0.27, as listed in the Apache Tomcat security bulletins of 12 October 2026 (cert.ssi.gouv.fr).
  • Assess exposure of JNDIRealm authentication, AJP, HTTP/2, Unix domain sockets, Jasper redirects and FIPS settings (gbhackers.com).
  • After updating, validate authentication, response isolation, socket permissions, redirect behavior and FIPS compliance (gbhackers.com).
  • Consult the vendor security pages for per-CVE details (cert.ssi.gouv.fr).

Relatos divergentes

  • Number of flaws: CERT-FR lists nine CVEs (cert.ssi.gouv.fr), while gbhackers.com speaks of eight vulnerabilities. The ninth CVE, CVE-2026-65183, appears in gbhackers.com only as an earlier, incomplete fix for CVE-2026-80353, so the difference is probably one of counting. The sources do not say so explicitly.
  • Detail level: only gbhackers.com gives severity ratings (three Important, five Low) and per-CVE descriptions. CERT-FR gives none, and its "unspecified security issue" is not mapped to a particular CVE.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 20/10/2026 21:00 · coletado 23/10 12:01

    CERT-FR: Multiple vulnerabilities in Apache Tomcat 9.0, 10.1 and 11.0 allow data disclosure and security bypass

    ler a análise desta fonte

    The CERT-FR advisory CERTFR-2026-AVI-1358 reports multiple vulnerabilities in Apache Tomcat. According to the advisory, an attacker could exploit them to breach data confidentiality, bypass the security policy, or trigger an unspecified security issue. The advisory lists nine CVEs and does not report active exploitation. Apache published fixes on 12 October 2026.

    Technical Details

    • Impact categories: confidentiality breach, security policy bypass, and an issue not specified by the vendor.
    • Affected versions: Tomcat 9.0.x before 9.0.123, Tomcat 10.1.x before 10.1.61, and Tomcat 11.0.x before 11.0.27.
    • CVEs: CVE-2026-101296, CVE-2026-101356, CVE-2026-103119, CVE-2026-65183, CVE-2026-74048, CVE-2026-74049, CVE-2026-80353, CVE-2026-88041, CVE-2026-93446.
    • The advisory gives no per-CVE details, CVSS scores or exploitation data.

    Remediation

    • Upgrade to Tomcat 9.0.123, 10.1.61 or 11.0.27, as listed in the Apache Tomcat security bulletins of 12 October 2026.
    • Consult the vendor security pages for per-CVE details.
  2. gbhackers.com ↗ · pub. 21/10/2026 06:05 · coletado 21/10 08:00 primeiro registro

    Apache Tomcat patches eight flaws including JNDIRealm authentication bypass and HTTP/2 cross-user data exposure

    ler a análise desta fonte

    Apache disclosed eight vulnerabilities in Apache Tomcat, three rated Important and five rated Low. They cover authentication bypass, cross-user data exposure, insecure socket access and cryptographic configuration failures. Fixes are in Tomcat 11.0.27, 10.1.61 and 9.0.123, depending on the branch. Exposure depends on the component and configuration in use, and the article reports no active exploitation.

    Technical Details

    • CVE-2026-101296: JNDIRealm using a non-GSSAPI SASL mechanism lacks a validation step, so attackers can authenticate without the correct password. It affects all three branches.
    • CVE-2026-103119: A buffer under-read in the AJP connector (Tomcat 11) during large non-blocking writes can split a response body between consecutive requests on one connection. This likely makes the second request fail, but could expose information from the first response.
    • CVE-2026-101356: Incorrect object recycling in HTTP/2 asynchronous servlet processing after an error can mix requests or responses between users.
    • CVE-2026-80353: A TOCTOU race in Unix domain socket creation via the APR/Native connector could let an unauthorized local user access the socket. The earlier fix for CVE-2026-65183 covered only the NIO connector.
    • CVE-2026-74049: The Jasper JSTL <c:redirect> replacement lacks page-abort behavior, so processing continues after a redirect.
    • CVE-2026-74048: When OpenSSL-FFM FIPS activation fails, Tomcat logs an error but continues with JSSE in non-FIPS mode.
    • CVE-2026-93446 and CVE-2026-88041: Incomplete cleanup causes intermittent TLS 1.3 connection failures and carry-over of HTTP/2 trailer information into subsequent requests.

    Remediation

    • Upgrade to the fixed release for each branch: 11.0.27, 10.1.61 or 9.0.123.
    • Assess exposure of JNDIRealm authentication, AJP, HTTP/2, Unix domain sockets, Jasper redirects and FIPS settings.
    • After updating, validate authentication, response isolation, socket permissions, redirect behavior and FIPS compliance.