---
title: Multiple vulnerabilities discovered in Apache Tomcat
url: https://www.dataloco.com/en/multiple-vulnerabilities-discovered-in-apache-tomcat
published: 2026-10-26T13:20:33+00:00
language: en
section: Security
source: https://www.security-next.com/191877
organizations: apache, tomcat
publisher: Dataloco
---

# Multiple vulnerabilities discovered in Apache Tomcat

Multiple vulnerabilities have been identified in the web application server Apache Tomcat. Some of these vulnerabilities have been evaluated as "critical" by security agencies.

On October 20, 2026, the Apache Software Foundation announced eight vulnerabilities based on CVE identifiers. The development team categorized three of these as "important" and the remaining five as "low."

Among the vulnerabilities classified as "important," CVE-2026-101296 poses a risk in the user authentication feature. It may allow authentication to pass without presenting the correct password under certain configurations using specific authentication methods.

Additionally, CVE-2026-101356 addresses an issue in asynchronous processing via HTTP/2. There is a risk that requests and responses from different users could be mixed during processing.

Another vulnerability marked as "important," CVE-2026-103119, affects the 11.0 branch. In the communication method AJP used for interactions with the web server, when writing large amounts of response data non-blockingly, parts of the response data for a previous request may become mixed with the response for the next request. This could lead to processing failures or data leaks.

## This story in other languages

- [한국어](https://www.dataloco.com/ko/apache-tomcat-8)
- [العربية](https://www.dataloco.com/ar/moss-abatshy-taaln-aan-thmany-thghrat-amny-fy-abatshy-tomkat-bma-fyha-tkyymat-hrg)
- [Türkçe](https://www.dataloco.com/tr/apache-tomcatte-8-adet-guvenlik-acigi-tespit-edildi)
- [Русский](https://www.dataloco.com/ru/obnaruzeno-8-uiazvimostei-v-apache-tomcat)
- [हिन्दी](https://www.dataloco.com/hi/epaca-tamakata-ma-aatha-sarakashha-kamazaraya-mal-tana-ka-gabharata-ucaca-satara-ka)
- [עברית](https://www.dataloco.com/he/apache-tomcat)
- [Deutsch](https://www.dataloco.com/de/acht-sicherheitsanfalligkeiten-bei-apache-tomcat-entdeckt)
- [Español](https://www.dataloco.com/es/ocho-vulnerabilidades-afectan-al-servidor-de-aplicaciones-apache-tomcat)
- [Français](https://www.dataloco.com/fr/huit-vulnerabilites-detectees-dans-apache-tomcat)
- [Nederlands](https://www.dataloco.com/nl/apache-tomcat-heeft-acht-kwetsbaarheden-waaronder-drie-met-hoge-prioriteit)
- [Svenska](https://www.dataloco.com/sv/flera-sarbarheter-upptackta-i-apache-tomcat)
- [Norsk](https://www.dataloco.com/no/flere-sarbarheter-oppdaget-i-apache-tomcat)
- [Polski](https://www.dataloco.com/pl/osiem-luk-bezpieczenstwa-w-apache-tomcat)
- [Português (Brasil)](https://www.dataloco.com/pt-br/oito-vulnerabilidades-identificadas-no-apache-tomcat)