SB2026102042 - Multiple vulnerabilities in Apache Tomcat

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102042

SB2026102042 - Multiple vulnerabilities in Apache Tomcat

Published: October 20, 2026

Security Bulletin ID SB2026102042
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 75% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-101356)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause requests or responses to be mixed up between users, potentially disclosing information or causing requests to be processed in the wrong user context.

The vulnerability exists due to incorrect object recycling and reuse in Apache Tomcat HTTP/2 asynchronous servlet processing when handling errors during asynchronous processing. A remote attacker can trigger affected request processing to cause request or response data to be associated with another user.


2) Missing Critical Step in Authentication (CVE-ID: CVE-2026-101296)

CWE-ID: CWE-304 - Missing Critical Step in Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass password authentication.

The vulnerability exists due to a missing critical authentication step in Apache Tomcat JNDIRealm when authenticating with a non-GSSAPI SASL mechanism. A remote attacker can attempt authentication without providing the correct password to gain access as an authenticated user.


3) Incomplete cleanup (CVE-ID: CVE-2026-93446)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause intermittent TLS 1.3 connection failures, disrupting access to the service.

The vulnerability exists due to incomplete cleanup in Apache Tomcat TLS connection handling when processing TLS 1.3 connections. A remote attacker can trigger affected connection handling to cause intermittent connection failures.


4) Incomplete cleanup (CVE-ID: CVE-2026-88041)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause HTTP/2 trailer information to cross request boundaries, potentially disclosing information or contaminating another request.

The vulnerability exists due to incomplete cleanup in Apache Tomcat HTTP/2 trailer header processing when handling successive requests. A remote attacker can trigger affected request processing to cause trailer information from a previous request to leak into a subsequent request.


5) Execution After Redirect (EAR) (CVE-ID: CVE-2026-74049)

CWE-ID: CWE-698 - Execution After Redirect (EAR)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause page processing to continue after a redirect, potentially executing application logic that was intended to be skipped.

The vulnerability exists due to failure to terminate page processing in the Apache Tomcat Jasper JSTL <c:redirect> plug-in replacement when issuing a redirect. A remote attacker can request a page that executes the affected redirect tag to cause the remaining page logic to run despite the redirect.


6) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-74048)

CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to benefit from TLS operation outside the configured FIPS restrictions after FIPS activation fails.

The vulnerability exists due to failing open in Apache Tomcat OpenSSLLifecycleListener when FIPS activation fails despite being configured for FIPS mode. A local user can take advantage of continued startup using JSSE in non-FIPS mode to bypass the intended FIPS operating requirement.


7) Buffer under-read (CVE-ID: CVE-2026-103119)

CWE-ID: CWE-127 - Buffer Under-read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to potentially obtain data from another response or cause a subsequent request to fail.

The vulnerability exists due to a buffer under-read in Apache Tomcat's AJP response processing when performing a large non-blocking write. A remote attacker can potentially receive part of a preceding response through a subsequent request on the same connection to disclose response data or cause a denial of service.


8) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-80353)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to gain unauthorized access to a Unix domain socket.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition in the Apache Tomcat APR/Native connector when creating Unix domain sockets and setting their permissions. A local user can exploit the timing window to access a socket without the intended authorization.


Remediation

Install update from vendor's website.

References