A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

[Web App Scanning] Apache Tomcat Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 9.0.0-M1 prior to 9.0.123, 10.1.0-M1 prior to 10.1.61 or 11.0.0-M1 prior to 11.0.27. It is, therefore, affected by multiple vulnerabilities :

- A buffer under-read in the AJP connector meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection, possibly leaking data from the first response to the second (11.0.x only). (CVE-2026-103119)

- Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. (CVE-2026-101356)

- When the JNDI realm was configured with a non-GSSAPI SASL authentication mechanism, attackers could authenticate without providing the correct password. (CVE-2026-101296)

- An incomplete cleanup vulnerability could cause TLS 1.3 connections to fail intermittently. (CVE-2026-93446)

- An incomplete cleanup vulnerability allowed HTTP/2 trailer information from a previous request to leak into a subsequent request. (CVE-2026-88041)

- A race condition when creating a Unix Domain Socket with the APR connector allowed an unauthorised local user to access the Unix Domain Socket, due to an incomplete fix for CVE-2026-65183 (9.0.x only). (CVE-2026-80353)

- The Jasper JSTL plug-in replacement for <c:redirect> does not immediately end processing, allowing the rest of the page to be processed despite the redirect. (CVE-2026-74049)

- If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs an error but continues to use JSSE in non-FIPS mode with the provided configuration. (CVE-2026-74048)

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.61. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.61_security-10 advisory.

  - A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was     configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without     providing the correct password. (CVE-2026-101296)

  - Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger     request and/or response mix-up between users. (CVE-2026-101356)

  - Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request     to leak into a subsequent request. (CVE-2026-88041)

  - Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.
    (CVE-2026-93446)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 11.0.27. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.27_security-11 advisory.

  - A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was     configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without     providing the correct password. (CVE-2026-101296)

  - A buffer under-read meant that a large non-blocking write could result in the response body being split     between the current request and the next request received on that connection leading most likely to     failure of the second request and possibly leakage of data from the first response to the second.
    (CVE-2026-103119)

  - Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger     request and/or response mix-up between users. (CVE-2026-101356)

  - Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.
    (CVE-2026-93446)

  - Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request     to leak into a subsequent request. (CVE-2026-88041)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.123. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.123_security-9 advisory.

  - A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was     configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without     providing the correct password. (CVE-2026-101296)

  - Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger     request and/or response mix-up between users. (CVE-2026-101356)

  - Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request     to leak into a subsequent request. (CVE-2026-88041)

  - Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.
    (CVE-2026-93446)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115718	Apache Tomcat 9.0.0-M1 < 9.0.123 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115717	Apache Tomcat 10.1.0-M1 < 10.1.61 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115716	Apache Tomcat 11.0.0-M1 < 11.0.27 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
367789	Apache Tomcat 10.1.55 < 10.1.61 multiple vulnerabilities	Nessus	Web Servers	Combined	critical
367788	Apache Tomcat 11.0.0.M25 < 11.0.27 multiple vulnerabilities	Nessus	Web Servers	Combined	critical
367787	Apache Tomcat 9.0.118 < 9.0.123 multiple vulnerabilities	Nessus	Web Servers	Combined	critical

Detections

Analytics

CVE-2026-101296

critical

Tenable Plugins

Coming Soon

critical

critical

critical

critical

critical

critical