CVE-2026-103119 Apache Tomcat: AJP response mix-up

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from...

CVE-2026-103119

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from...

EUVD-2026-105012

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from...

CVE-2026-103119 Apache Tomcat: AJP response mix-up

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from...

CVE-2026-103119

A buffer under-read vulnerability in Apache Tomcat (versions 11.0.0-M25 through 11.0.26) allows a large non-blocking write to split a response body between the current and subsequent requests on the same connection. This can lead to the failure of the second request and the potential leakage of d...

CVE-2026-101356

Apache Tomcat is vulnerable to an incorrect object recycling and re-use flaw affecting HTTP/2 processing of asynchronous servlets . This vulnerability can trigger a request and/or response mix-up between different users. The issue impacts versions 11.0.22 through 11.0.26 , 10.1.55 through 10.1.60...

CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

EUVD-2026-105011

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

CVE-2026-101356 Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

CVE-2026-101356 Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

CVE-2026-101296

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through...

EUVD-2026-105010

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through...

CVE-2026-101296 Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through...

CVE-2026-101296 Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through...

CVE-2026-101296

A missing verification step in Apache Tomcat allows an unauthenticated remote attacker to bypass authentication when the JNDI realm is configured with a non-GSSAPI SASL mechanism. This flaw enables unauthorized access to protected resources by allowing authentication without a correct password. A...

CVE-2026-93446

Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or...

CVE-2026-93446 Apache Tomcat: Possible TLS 1.3 connection failures

Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or...

CVE-2026-93446

Apache Tomcat versions 11.0.0-M21 through 11.0.26 , 10.1.25 through 10.1.60 , and 9.0.90 through 9.0.122 are affected by an incomplete cleanup vulnerability. This issue can cause TLS 1.3 connections to fail intermittently. To remediate this, users are recommended to upgrade to versions 11.0.27 , ...

EUVD-2026-105008

Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or...

CVE-2026-88041

Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrad...