Fixed in Apache Tomcat 10.1.39

Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind CVE-2026-55957 When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker was able authenticate without providing the correct password. This was fixed with commits 0cd21c03. This issue was reporte...

Fixed in Apache Tomcat 9.0.118

Moderate: Security constraints not correctly applied CVE-2026-43515 When multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. This was fixed with commit db919ff9. This issue was reported to the Tomcat securit...

Fixed in Apache Tomcat Native Connector 2.0.12 / 1.3.5

Moderate: Incomplete OCSP verification checks CVE-2026-24734 When using an OCSP responder, Tomcat Native did complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This issue was reported to the Tomcat security team on 2 November...

Fixed in Apache Tomcat 11.0.12

Low: Delayed cleaning of multipart upload temporary files may lead to DoS CVE-2025-61795 If an error occurred including exceeding limits during the processing of a multipart upload, temporary copies of the uploaded parts written to local storage were not cleaned up immediately but left for the...

Fixed in Apache Tomcat 9.0.110

Low: Delayed cleaning of multipart upload temporary files may lead to DoS CVE-2025-61795 If an error occurred including exceeding limits during the processing of a multipart upload, temporary copies of the uploaded parts written to local storage were not cleaned up immediately but left for the...

Fixed in Apache Tomcat 11.0.5

Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind CVE-2026-55957 When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker was able authenticate without providing the correct password. This was fixed with commits fd96ab41. This issue was reporte...