Hi,
The following vulnerabilities were published for tomcat11.
CVE-2026-101296[0]:
| A missing critical step in authentication vulnerability in Apache
| Tomcat when the JNDI realm was configured with with a non GSSAPI
| SASL authentication mechanism allowed attackers to authenticate
| without providing the correct password. This issue affects Apache
| Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through
| 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions
| were EOL at the time the CVE was created but are known to be
| affected: from 8.5.0 through 8.5.100, from 7.0.0 through
| 7.0.109. Other unsupported versions may also be affected. Users
| are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123,
| which fix the issue.
CVE-2026-101356[1]:
| Incorrect object recycling and re-use vulnerability in Apache Tomcat
| affecting HTTP/2 processing of asynchronous servlets can trigger
| request and/or response mix-up between users. This issue affects
| Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through
| 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to
| upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the
| issue.
CVE-2026-103119[2]:
| Buffer under-read vulnerability in Apache Tomcat meant that a large
| non-blocking write could result in the response body being split
| between the current request and the next request received on that
| connection leading most likely to failure of the second request and
| possibly leakage of data from the first response to the second.
| This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.
| Users are recommended to upgrade to version 11.0.27, which fixes the
| issue.
CVE-2026-74048[3]:
| Not Failing Securely ('Failing Open') vulnerability in Apache
| Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS
| mode but FIPS activation fails, Tomcat logs and error but continues
| to use JSSE in non-FIPS mode with the provided configuration.
| This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26,
| from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users
| are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123,
| which fix the issue.
CVE-2026-74049[4]:
| Execution After Redirect (EAR) vulnerability in Apache Tomcat.
| This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26,
| from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
| The following versions were EOL at the time the CVE was created but
| are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0
| through 7.0.109. Other unsupported versions may also be affected.
| Users are recommended to upgrade to version 11.0.27, 10.1.61,
| 9.0.123, which fixes the issue.
CVE-2026-88041[5]:
| Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer
| information from a previous request to leak into a subsequent
| request. This issue affects Apache Tomcat: from 11.0.0-M23
| through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through
| 9.0.122. Users are recommended to upgrade to version 11.0.27,
| 10.1.61 or 9.0.123, which fix the issue.
CVE-2026-93446[6]:
| Incomplete cleanup vulnerability in Apache Tomcat could cause TLS
| 1.3 connections to fail intermittently. This issue affects Apache
| Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through
| 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to
| upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-101296
https://www.cve.org/CVERecord?id=CVE-2026-101296
[1] https://security-tracker.debian.org/tracker/CVE-2026-101356
https://www.cve.org/CVERecord?id=CVE-2026-101356
[2] https://security-tracker.debian.org/tracker/CVE-2026-103119
https://www.cve.org/CVERecord?id=CVE-2026-103119
[3] https://security-tracker.debian.org/tracker/CVE-2026-74048
https://www.cve.org/CVERecord?id=CVE-2026-74048
[4] https://security-tracker.debian.org/tracker/CVE-2026-74049
https://www.cve.org/CVERecord?id=CVE-2026-74049
[5] https://security-tracker.debian.org/tracker/CVE-2026-88041
https://www.cve.org/CVERecord?id=CVE-2026-88041
[6] https://security-tracker.debian.org/tracker/CVE-2026-93446
https://www.cve.org/CVERecord?id=CVE-2026-93446
Regards,
Salvatore