Apache Tomcat

Everything SecOps Signal has reported about Apache Tomcat: 2 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

Apache Tomcat JNDI Realm Auth Flaw Skips Validation in Versions 7.0 to 11.0

A flaw in Apache Tomcat’s JNDI realm authentication fails to validate credentials for non-GSSAPI SASL mechanisms, allowing potential unauthorized access across multiple major versions.

Oct 20, 2026

Vulnerabilities

Apache Tomcat HTTP/2 Async Patch Fixes CVE-2026-101356 Request Mix-Up

A vulnerability in Apache Tomcat allows mixed HTTP/2 requests between users during asynchronous processing. Affected versions require immediate upgrade to 11.0.27, 10.1.61 or 9.0.123.

Oct 20, 2026