Science & Tech · Cybersecurity · 2 hrs ago
Apache Tomcat fixes eight vulnerabilities across versions 9, 10 and 11
The Apache Software Foundation disclosed eight vulnerabilities in Apache Tomcat on October 20.
Tomcat is software used to run Java web applications, and the flaws affect its 9, 10 and 11 version lines.
Three flaws were rated Important by Apache, while the US cybersecurity agency CISA gave those same flaws a CVSS score of 9.1, classified as Critical.
One could allow authentication to succeed without the correct password in certain configurations, and another could mix up requests or responses between users.
The issues affect particular versions and features, so not every Tomcat installation is exposed to every flaw.
Fixed versions were released on October 12: Tomcat 9.0.123, 10.1.61 and 11.0.27.
Administrators should update to the version for their Tomcat line; the sources say the Tomcat 9.0 series is due to lose support on March 31, 2027.
Apache Tomcat’s developers disclosed eight vulnerabilities affecting versions in the 9, 10 and 11 series on October 20.
Fixed versions 9.0.123, 10.1.61 and 11.0.27 had been released on October 12.
Three vulnerabilities were rated Important by the Apache Software Foundation, while the US Cybersecurity and Infrastructure Security Agency assigned them a CVSS score of 9.1, classified as Critical.
The flaws include risks of authentication bypass and requests or responses being mixed up between users.
Apache recommends updating to a fixed version; some affected older releases are no longer supported and have no fix.
- Who
- The Apache Software Foundation’s Tomcat development team disclosed the vulnerabilities.
- What
- Eight vulnerabilities affect Apache Tomcat; fixed releases are available.
- When
- The vulnerabilities were disclosed on October 20, 2026; the fixes were released on October 12.
- Where
- Apache Tomcat versions in the 9, 10 and 11 series are affected.
- Why
- Not stated
This story does not have two clearly opposing sides.
Apache released Tomcat versions 9.0.123, 10.1.61 and 11.0.27 with fixes.
The Apache Software Foundation disclosed eight vulnerabilities in Tomcat.
Japan’s vulnerability information site JVN published an advisory about the vulnerabilities.
- Vulnerabilities disclosed
- 8
- Fixed versions
- 9.0.123, 10.1.61 and 11.0.27
- Apache ratings
- 3 Important; 5 Low
- CISA scores
- Three vulnerabilities scored 9.1
- Affected series
- Tomcat 9, 10 and 11
3 sources
What people are saying
いずれの脆弱性も10月12日にリリースされた「Apache Tomcat」v9.0.123 / v10.1.61 / v11.0.27にアップデートすることで対処可能。
Posts on X
Apache Tomcat 10.1.61, 9.0.123 and 11.0.27 are now available for download: https://t.co/boyAwqChum Tomcat s an open source software implementation of the Jakarta Servlet, Jakarta Pages, and more.