Vulnerabilities
Update Tomcat 9-11 immediately to fix CVE-2026-101296 JNDI realm SASL auth bypass critical flaw
Attackers can bypass passwords in Apache Tomcat 7.0 through 11.0 if JNDI realms use specific SASL settings, requiring immediate upgrades.
Apache Software Foundation
Everything Shell Bulletin has reported about Apache Software Foundation: 2 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Download Apache Tomcat 11.0.27 Now to Prevent Cross-Request Data Leaks in AJP Protocol
A buffer under-read flaw in Apache Tomcat 11 allows response data to leak into subsequent requests on the same connection, risking sensitive information exposure.