Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN1053 _____________________________________________________________________ DATE : 21/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Apache Tomcat versions prior to 11.0.27, 10.1.61, 9.0.122. ==================================================================== https://lists.apache.org/thread.html/sk2cg4k077fwcqbm6tqz2n700nq06h80 https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27 https://lists.apache.org/thread.html/bl52b9go9ckoov8x4v3dt6rkm573cygd https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw https://lists.apache.org/thread.html/dnmm9l3byytg3l66nk1jrqfrl7jty7n1 https://lists.apache.org/thread.html/tr0q87qwvs80p9hc53tkwpzvnx0ywftr https://lists.apache.org/thread.html/lolc9wo4tzjog2tnwctv93hz9gjcdnc6 https://lists.apache.org/thread.html/v5ry0sx1c7x1wr5mx4cddj3p3mv1ho6m _____________________________________________________________________ [SECURITY] CVE-2026-103119 Apache Tomcat - AJP response mix-up CVE-2026-103119 Apache Tomcat - AJP response mix-up Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M25 to 11.0.26 Description: A buffer under-read meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. Mitigation: Users of the affected versions should apply one of the following mitigations: - Upgrade to Apache Tomcat 11.0.27 Credit: This issue was identified by: - Tuomo Hänninen History: 2026-10-20 Original advisory References: [1] https://tomcat.apache.org/security-11.html _____________________________________________________________________ CVE-2026-101356 Apache Tomcat - HTTP/2 request/response mix-up after error during async processing Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.22 to 11.0.26 Apache Tomcat 10.1.55 to 10.1.60 Apache Tomcat 9.0.118 to 9.0.122 Description: Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. Mitigation: Users of the affected versions should apply one of the following mitigations: - Upgrade to Apache Tomcat 11.0.27 - Upgrade to Apache Tomcat 10.1.61 - Upgrade to Apache Tomcat 9.0.123 History: 2026-10-20 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-101296 Apache Tomcat - JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.26 Apache Tomcat 10.1.0-M1 to 10.1.60 Apache Tomcat 9.0.0.M1 to 9.0.122 Description: A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. Mitigation: Users of the affected versions should apply one of the following mitigations: - Upgrade to Apache Tomcat 11.0.27 - Upgrade to Apache Tomcat 10.1.61 - Upgrade to Apache Tomcat 9.0.123 Credit: This issue was identified by: - Sai Sreewathsa Kovalluri, Shon Babu, and Kannan K of Innspark Solutions Private Limited History: 2026-10-20 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-93446 Apache Tomcat - Possible TLS 1.3 connection failures Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M21 to 11.0.26 Apache Tomcat 10.1.25 to 10.1.60 Apache Tomcat 9.0.90 to 9.0.122 Description: Incomplete cleanup could cause TLS 1.3 connections to fail intermittently. Mitigation: Users of the affected versions should apply one of the following mitigations: - Upgrade to Apache Tomcat 11.0.27 - Upgrade to Apache Tomcat 10.1.61 - Upgrade to Apache Tomcat 9.0.123 Credit: This issue was identified by: - FHMTT (https://github.com/FHMTT) History: 2026-10-20 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-88041 Apache Tomcat - HTTP/2 trailer header cross-contamination Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M23 to 11.0.26 Apache Tomcat 10.1.27 to 10.1.60 Apache Tomcat 9.0.92 to 9.0.122 Description: Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. Mitigation: Users of the affected versions should apply one of the following mitigations: - Upgrade to Apache Tomcat 11.0.27 - Upgrade to Apache Tomcat 10.1.61 - Upgrade to Apache Tomcat 9.0.123 Credit: This issue was identified by: - Wentao He History: 2026-10-20 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-80353 Apache Tomcat - TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.47 to 9.0.122 Description: Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. Mitigation: Users of the affected versions should apply one of the following mitigations: - Upgrade to Apache Tomcat 9.0.123 Credit: This issue was identified by: - h1ei1 History: 2026-10-20 Original advisory References: [1] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-74049 Apache Tomcat - Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE) Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.26 Apache Tomcat 10.1.0-M1 to 10.1.60 Apache Tomcat 9.0.0.M1 to 9.0.122 Description: The Jasper JSTL plug-in replacement for the does not immediately end processing, allowing the rest of the page to be processed despite the redirect. Mitigation: Users of the affected versions should apply one of the following mitigations: - Upgrade to Apache Tomcat 11.0.27 - Upgrade to Apache Tomcat 10.1.61 - Upgrade to Apache Tomcat 9.0.123 Credit: This issue was identified by: - 0xCc.zhang History: 2026-10-20 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html _____________________________________________________________________ CVE-2026-74048 Apache Tomcat - OpenSSL-FFM FIPS failure does not prevent start-up Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M14 to 11.0.26 Apache Tomcat 10.1.22 to 10.1.60 Apache Tomcat 9.0.92 to 9.0.122 Description: If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. Mitigation: Users of the affected versions should apply one of the following mitigations: - Upgrade to Apache Tomcat 11.0.27 - Upgrade to Apache Tomcat 10.1.61 - Upgrade to Apache Tomcat 9.0.123 Credit: This issue was identified by: - 0xCc.zhang History: 2026-10-20 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================