Apache Tomcat Vulnerabilities 2026: CVE-2026-101356 and CVE-2026-101296 Patch Guide

Introduction

Apache Tomcat administrators should review their versions after CERT-In published a critical vulnerability note on 29 October 2026. The notice covers multiple issues that can affect authentication and the separation of requests or responses between users.

The practical message is simple: identify the Tomcat version, check whether the affected authentication or HTTP/2 configurations are in use, and apply the vendor’s fixed release through a controlled change process. Do not treat a version upgrade as a substitute for checking logs, access records and application behaviour.

**Short answer:** CVE-2026-101356 concerns an HTTP/2 request/response mix-up after an error during asynchronous processing. CVE-2026-101296 concerns JNDIRealm credential validation failing open for certain non-GSSAPI SASL configurations. CERT-In lists Tomcat 11.0.26 and prior, 10.1.60 and prior, and 9.0.122 and prior as affected lines.

What CERT-In reported about Apache Tomcat

CERT-In’s CIVN-2026-0532 describes a critical group of Apache Tomcat vulnerabilities. The risk is not limited to a crash. An authentication bypass can allow an attacker to reach functionality without the expected password check. A request or response mix-up can expose information across user sessions or cause one user’s request context to be associated with another.

That does not mean every Tomcat installation is exploitable in the same way. Exposure depends on the installed version, connector and protocol settings, authentication realm, application design and whether the vulnerable path is reachable. It does mean that teams should not dismiss the advisory because the Tomcat server sits behind an application or reverse proxy.

Which Tomcat versions need attention?

CERT-In lists these affected ranges:

Apache’s security pages identify fixes in the 11.0.27 and 10.1.61 release lines for the important issues described here. Organisations should confirm the correct fixed release for their supported branch and follow their normal Java runtime, application compatibility and rollback process.

Older or unsupported branches deserve extra scrutiny. If a business application cannot be upgraded immediately, document the exception, reduce exposure, restrict administrative interfaces and apply compensating controls while a tested upgrade is prepared.

• Apache Tomcat 11.0.x: 11.0.26 and prior
• Apache Tomcat 10.1.x: 10.1.60 and prior
• Apache Tomcat 9.0.x: 9.0.122 and prior

How CVE-2026-101356 can affect users

CVE-2026-101356 is associated with incorrect object recycling and reuse during HTTP/2 asynchronous processing. Under the affected conditions, a request or response can be mixed up between users. The security concern is confidentiality and session separation: content intended for one request may be returned in another context.

Defenders should review whether HTTP/2 and asynchronous servlet processing are enabled, whether applications return sensitive data in responses, and whether access logs show unusual cross-account behaviour. A log anomaly is not proof of exploitation, but it can help investigators decide where to look after an upgrade.

How CVE-2026-101296 relates to authentication

CVE-2026-101296 affects JNDIRealm authentication when a non-GSSAPI SASL mechanism is configured and credential validation can fail open. In plain language, an attacker may be able to authenticate without providing the correct password under the relevant configuration.

Teams using directory-backed authentication should inventory realm settings rather than assuming that “LDAP is enabled” is enough information. Confirm the authentication mechanism, test both valid and invalid credentials in a safe environment, review failed-login telemetry and ensure management applications are not exposed to the public internet.

What administrators should do today

1. Inventory all Tomcat instances, including embedded or application-bundled deployments.

2. Record the exact Tomcat, Java, connector, HTTP/2 and authentication-realm versions.

3. Prioritise internet-facing systems and systems processing personal, financial or health information.

4. Upgrade through the fixed Apache Tomcat release after application testing and a rollback rehearsal.

5. Review authentication logs, HTTP/2 errors, unusual session activity and unexpected response content.

6. Remove unused default applications and protect Manager, Host Manager and JMX interfaces.

7. Restrict management access by network location and use strong, unique credentials.

8. Keep a dated record of the advisory, affected asset, decision, test result and deployment owner.

Tomcat hardening beyond the patch

Apache’s own security guidance recommends removing default applications that are not required, restricting management applications, limiting JMX to trusted networks and configuring access logging. These controls reduce exposure but do not replace patching.

Also review upload and deployment features. WebDAV, HTTP PUT and remote deployment functions can create a high-impact path when they are available to untrusted users. Keep application files and temporary directories protected by appropriate operating-system permissions, and avoid deploying untrusted web applications.

Frequently asked questions

### Is Apache Tomcat 10.1.60 safe from these issues?

No. CERT-In lists 10.1.60 and prior as affected. Confirm the current fixed release and upgrade path from Apache before declaring the system remediated.

### Is this automatically a remote code execution vulnerability?

The CERT-In note focuses on authentication bypass, request/response mix-ups, unauthorized access and possible information disclosure or compromise. This article does not claim that every affected deployment provides remote code execution.

### Should I disable HTTP/2 immediately?

That is an environment-specific containment decision. If disabling the affected feature is safe for the application, it may reduce exposure while testing a fix, but teams should validate availability and document the change.

Conclusion

Apache Tomcat remains widely used in Java application stacks, so a critical advisory deserves an asset-level response rather than a quick version check. Identify affected instances, understand whether JNDIRealm or HTTP/2 paths apply, upgrade to the appropriate fixed release, review logs and harden management interfaces. For broader defensive context, read Cyberoinfo’s [basic network security concepts](/articles/basic-network-security-concepts) and [cybersecurity risks for small business](/articles/cybersecurity-risks-for-small-business).

Decision checklist

• Apache Tomcat 11.0.x: 11.0.26 and prior
• Apache Tomcat 10.1.x: 10.1.60 and prior
• Apache Tomcat 9.0.x: 9.0.122 and prior

Limitations

• Reporting channels, procedures and security guidance can change; verify current instructions before acting.

Evidence sources

1. cert-in.org.in — CERT-In CIVN-2026-0532
2. tomcat.apache.org — Apache Tomcat 10 Security
3. tomcat.apache.org — Apache Tomcat 11 Security
4. tomcat.apache.org — Apache Tomcat Security Considerations