Apache Tomcat Multiple Vulnerabilities – Immediate Patch Required

What happened

On 21 October 2026 the CERT‑FR team identified a set of critical flaws in Apache Tomcat. The flaws span several major releases and are capable of leaking sensitive data and bypassing security controls.

Three separate CVEs – CVE‑2026‑101296, CVE‑2026‑101356, and CVE‑2026‑103119 – were published in the same advisory, followed by CVE‑2026‑65183, CVE‑2026‑74048 and CVE‑2026‑74049. Each CVE targets a different component of the servlet container, but all share a common root: improper validation of request parameters and configuration files.

Who is affected

Any deployment running a Tomcat instance older than the following fixed releases is vulnerable:

• Apache Tomcat 10.1.x before 10.1.61
• Apache Tomcat 11.0.x before 11.0.27
• Apache Tomcat 9.0.x before 9.0.123

This includes both the community editions and the commercial distributions that embed Tomcat as a web server or servlet container.

Impact

The most severe consequence is a confidentiality breach. An attacker can craft a request that forces Tomcat to expose the contents of protected files, including application secrets and configuration data.

In addition, the flaws allow a policy bypass. Security‑manager checks and web‑application firewall rules can be circumvented, giving the attacker elevated privileges within the application context.

Exposure

All of the CVEs can be triggered remotely via HTTP/HTTPS traffic. The attacker does not need to authenticate or have prior access; a single crafted request is sufficient to trigger the vulnerability.

Because the flaws involve parsing of request headers and query strings, they can be exploited from any network segment that can reach the Tomcat service, including public internet, internal networks, and VPN tunnels.

What to do

Defenders should immediately upgrade to the latest Tomcat releases:

• Tomcat 10.1.61 or newer
• Tomcat 11.0.27 or newer
• Tomcat 9.0.123 or newer

Apply the vendor‑provided patches for the affected components and verify that the security‑manager is enabled. If an upgrade is not feasible, isolate the vulnerable instances behind a Web Application Firewall and block all non‑essential HTTP methods.

What to watch

Monitor logs for anomalous request patterns such as unusually long query strings, repeated attempts to access /WEB-INF or /META-INF directories, and repeated 400/500 HTTP status codes.

Stay alert for new advisories from Apache and CERT‑FR, and keep an inventory of all Tomcat instances to ensure that no legacy version remains in production.