Servers, proxies and network services

Apache Tomcat: CVE-2026-103119 and CVE-2026-101356 check

Apache Tomcat October 2026 check

Two Tomcat bugs disclosed on 20 October 2026 can hand one user's response, or part of it, to another user. Both are request and response mix-ups, which on a site with logins can mean one person is shown another person's page.

Both were announced on oss-security by Mark Thomas of the Tomcat team on 20 October 2026. The AJP bug was found by Tuomo Hänninen. The advisory for the HTTP/2 bug does not name a finder.

Quick start

1. Download the script. The repository is mirrored on GitHub and Codeberg; pick a base URL.

   # BASE from GitHub:   https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main
   # BASE from Codeberg: https://codeberg.org/PrivacySafe/security-patches/raw/branch/main
   # curl -fLO "$BASE/tomcat/tomcat-oct2026-check.sh"
   curl -fLO https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main/tomcat/tomcat-oct2026-check.sh
   

2. Read it before running it, then make it executable.

   less tomcat-oct2026-check.sh
   chmod +x tomcat-oct2026-check.sh
   

3. Check this host. With no arguments the script looks at CATALINA_HOME, CATALINA_BASE, running Tomcat processes and the usual install paths (/opt/tomcat*, /opt/apache-tomcat*, /usr/share/tomcat*, /usr/local/tomcat, /var/lib/tomcat*). To check a specific install, pass its directory.

   ./tomcat-oct2026-check.sh check
   ./tomcat-oct2026-check.sh check /srv/tomcat-app1
   

Commands

Environment: STATE_DIR (default /var/lib/psf-security-patches/tomcat) holds the backups and manifest.

Exit codes of check: 0 nothing exposed, 1 an affected version is exposed or its configuration could not be read, 2 bad arguments.

Commands that change the host need root. Run them with sudo from an admin account, not from a root login, so the change is recorded against a person. The script stops and prints the exact command if you forget:

sudo ./tomcat-oct2026-check.sh mitigate --dry-run
sudo ./tomcat-oct2026-check.sh mitigate
sudo ./tomcat-oct2026-check.sh rollback

How to read the result

• Affected version and the feature is on: exposed. Upgrade and restart.
• Affected version, the feature is off in server.xml: the script prints a warning and exits 0. The flaw is not reachable through that path today, but a config change would reopen it, so upgrade anyway.
• server.xml not found: the script cannot decide, so it treats the install as exposed and exits 1.
• Version string and distribution backports. Debian, Ubuntu, RHEL and others backport fixes without changing the upstream version. For installs owned by a dpkg or rpm package the script reads the package changelog and reports a mention of either CVE. If the changelog does not mention them yet, it says so. Check your distribution's security tracker.
• Milestones. CVE-2026-103119 is listed from 11.0.0-M25. Older 11.0.0 milestones are development builds, and the script treats every 11.x below 11.0.27 as affected.

What it cannot see

• Running containers are checked; images that are not running are not. See the container note below. For an image that is not running, compare its tag with the fixed versions.
• Which servlets are asynchronous. For CVE-2026-101356 the script reports HTTP/2 as enabled. It cannot tell from configuration whether your applications use asynchronous servlets, so treat HTTP/2 as exposed.
• Connectors defined outside server.xml , for example through embedded Tomcat in a Spring Boot jar. Check those applications' own dependencies.

Protective measures while you upgrade

mitigate --ajp and mitigate --http2 apply these (see Commands). xmllint confirms that the edited server.xml is well-formed. Verified on Tomcat 10.1.55 (the Ubuntu package), which is in the HTTP/2 range: with an HTTP/2 UpgradeProtocol on the 8080 connector, HTTP/2 worked both by prior knowledge and by upgrade. After mitigate --http2 and a restart it did not, plain HTTP/1.1 still answered, Tomcat started with the commented element, and rollback restored server.xml exactly and HTTP/2 with it. mitigate --ajp correctly did nothing on 10.1.55, which is outside the AJP range.

These are PrivacySafe's measures from the advisory text, and they reduce exposure without fixing the bug.

• AJP: if you do not need AJP, remove or comment out the AJP Connector and proxy over HTTP instead. The bug is in how the response is framed on a shared connection, so it appears not to depend on authentication. Do not treat setting an AJP secret as a mitigation.
• HTTP/2: remove the UpgradeProtocol element from the Connector, and let the front proxy (Apache mod_proxy_http, nginx, HAProxy) speak HTTP/1.1 to Tomcat. Clients can still use HTTP/2 to the proxy.

Sources

• CVE-2026-103119: oss-security announcement
• CVE-2026-101356: oss-security announcement

Before you run it

• The fix. Update to 11.0.27, 10.1.61 or 9.0.123. The script never starts, stops or edits Tomcat.
• It reads the exact version from lib/catalina.jar and reads server.xml to see whether the AJP connector and HTTP/2 are switched on, since each flaw needs its feature.
• Both flaws can hand one user's response to another. CVE-2026-103119 is AJP on 11.0.x. CVE-2026-101356 is HTTP/2 with asynchronous servlets on 9.0, 10.1 and 11.0.
• There is no hunt. No indicators of exploitation have been published.
• It also checks running docker and podman containers, unless you name a directory or set SCAN_CONTAINERS=0. A read-only probe inside each running docker and podman container captures lib/catalina.jar, RELEASE-NOTES and conf/server.xml for each Tomcat home (with every ...Pass... and secret attribute redacted inside the container before it is copied) into a private temporary directory. The script then runs once per container, in isolation, against that copy, so one container's configuration never changes another's result. The AJP and HTTP/2 checks read the container's own server.xml. The copies are removed on exit. A path shown as .../docker_NAME/... is inside the container NAME. It is skipped when you name a binary or directory yourself.

Red Hat advisories

Red Hat's advisory list (security advisories released 2026-04-01 to 2026-11-03) names the CVEs below. A Red Hat build is judged by its RPM release, not by the upstream version number, because Red Hat backports fixes: the advisory names the release that fixes it. A CVE with no advisory in the list has none for that period, which is not the same as not affected. The current state is on Red Hat's CVE database.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.

Edit this page on Codeberg