Fixed in Apache Tomcat 11.0.5

Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind CVE-2026-55957 When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker was able authenticate without providing the correct password. This was fixed with commits fd96ab41. This issue was reporte...

Fixed in Apache Tomcat 10.1.59

Note: The issues below were fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for these issues, version 10.1.58 is not included in the list of affected version...