AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783356847)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783356847 advisory. - Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any...

CentOS Linux 7 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (CENTOS7:CLSA-2026:1783591320)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1783591320 advisory. - Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2026:1783522891)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783522891 advisory. - Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI...

AlmaLinux 8 : tomcat (ALSA-2026:68677)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68677 advisory. tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43512 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not...

tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration

A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct...

tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration

A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct...

tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration

A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct...

tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration

A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct...

tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration

A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct...

Important: Red Hat Security Advisory: tomcat security update

An update for tomcat is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syst...

tomcat security update

1:9.0.120-1 - Resolves: RHEL-192806 HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-219561 Security constraint bypass via improper URL encoding in rewrite valve CVE-2026-59083 - Resolves: RHEL-219581 Insufficient documentation for EncryptInterceptor may lead to insecure...

tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration

A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct...

tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration

A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct...

The vulnerability of the JNDIRealm component in the Apache Tomcat application server allows a hacker to bypass security restrictions.

The vulnerability of the JNDIRealm component in the Apache Tomcat application server is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions remotely...

tomcat6: Fix of CVE-2026-55957

CVE-2026-55957: tomcat6: JNDIRealm GSSAPI authenticated bind allowed authentication without the correct password...

Amazon Linux 2 : tomcat, --advisory ALAS2-2026-3864 (ALAS-2026-3864)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3864 advisory. Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds usi...

Important: tomcat

Issue Overview: Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, fro...

CVE-2026-55957

A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct...

Exploit for Missing Critical Step in Authentication in Apache Tomcat

CVE-2026-55957 isolated reproduction lab This repository repr...

Linux Distros Unpatched Vulnerability : CVE-2026-55957

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to...