Security Advisory

Apache Tomcat Security Update Advisory

  • Nov 06 2026
Apache Tomcat Security Update Advisory

Overview

A security update addressing several vulnerabilities in Apache Tomcat has been released. Users of this product should update to the latest version.

Affected Products and Versions

  • CVE-2026-80353: Apache Tomcat 9.0.47 through 9.0.122. – CVE-2026-88041: Apache Tomcat 9.0.92 through 9.0.122, Apache Tomcat 10.1.27 through 10.1.60, and Apache Tomcat 11.0.0-M23 through 11.0.26.
  • CVE-2026-93446: Apache Tomcat 9.0.90 through 9.0.122, Apache Tomcat 10.1.25 through 10.1.60, Apache Tomcat 11.0.0-M21 through 11.0.26.
  • CVE-2026-101296: Apache Tomcat 9.0.0.M1 through 9.0.122, Apache Tomcat 10.1.0-M1 through 10.1.60, Apache Tomcat 11.0.0-M1 through 11.0.26.
  • CVE-2026-101356: Apache Tomcat 9.0.118 through 9.0.122, Apache Tomcat 10.1.55 through 10.1.60, Apache Tomcat 11.0.22 through 11.0.26.
  • CVE-2026-103119: Apache Tomcat 11.0.0-M25 through 11.0.26.

Resolved Vulnerabilities

  • CVE-2026-80353: A race condition (TOCTOU, where the state of a resource changes between the time of a check and the time of use) vulnerability.
  • CVE-2026-88041: Incomplete cleanup vulnerability (an issue where residual state is not fully removed after processing). – CVE-2026-93446: Incomplete cleanup vulnerability.
  • CVE-2026-101296: Vulnerability involving the omission of a critical step in the authentication process. – CVE-2026-101356: Race condition vulnerability (an issue where the result varies depending on the order of processing).
  • CVE-2026-103119: Buffer under-read vulnerability (an issue where the beginning of memory is read incorrectly).

Patch Version

  • CVE-2026-80353: Apache Tomcat 9.0.123.
  • CVE-2026-88041, CVE-2026-93446, CVE-2026-101296, CVE-2026-101356: Apache Tomcat 9.0.123, 10.1.61, 11.0.27.
  • CVE-2026-103119: Apache Tomcat 11.0.27.

Note

The reference site contains detailed information on each CVE.

Tags:
Previous Post

Next Post