{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Apache Software Foundation Apache Tomcat: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/apache-software-foundation--apache-tomcat/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/apache-software-foundation--apache-tomcat/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103119/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103119/",
   "title": "CVE-2026-103119 disclosed",
   "content_text": "Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, which fixes the issue.",
   "date_published": "2026-10-20T13:54:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103119/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103119/",
   "title": "CVE-2026-103119 fixed in openSUSE:Tumbleweed",
   "content_text": "Fixed versions: tomcat11 11.0.27-1.1.",
   "date_published": "2026-10-20T13:54:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101356/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101356/",
   "title": "CVE-2026-101356 disclosed",
   "content_text": "Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.",
   "date_published": "2026-10-20T13:46:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101356/fixed/debian-12",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101356/",
   "title": "CVE-2026-101356 fixed in Debian:12",
   "content_text": "Fixed versions: tomcat9 9.0.70-2.",
   "date_published": "2026-10-20T13:46:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101356/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101356/",
   "title": "CVE-2026-101356 fixed in Debian:13",
   "content_text": "Fixed versions: tomcat9 9.0.70-2.",
   "date_published": "2026-10-20T13:46:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101356/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101356/",
   "title": "CVE-2026-101356 fixed in Debian:14",
   "content_text": "Fixed versions: tomcat9 9.0.70-2.",
   "date_published": "2026-10-20T13:46:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101356/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101356/",
   "title": "CVE-2026-101356 fixed in openSUSE:Tumbleweed",
   "content_text": "Fixed versions: tomcat 9.0.123-1.1, tomcat10 10.1.61-1.1, tomcat11 11.0.27-1.1.",
   "date_published": "2026-10-20T13:46:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101296/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101296/",
   "title": "CVE-2026-101296 disclosed",
   "content_text": "A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.",
   "date_published": "2026-10-20T13:45:39Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101296/fixed/debian-12",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101296/",
   "title": "CVE-2026-101296 fixed in Debian:12",
   "content_text": "Fixed versions: tomcat9 9.0.70-2.",
   "date_published": "2026-10-20T13:45:39Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101296/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101296/",
   "title": "CVE-2026-101296 fixed in Debian:13",
   "content_text": "Fixed versions: tomcat9 9.0.70-2.",
   "date_published": "2026-10-20T13:45:39Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101296/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101296/",
   "title": "CVE-2026-101296 fixed in Debian:14",
   "content_text": "Fixed versions: tomcat9 9.0.70-2.",
   "date_published": "2026-10-20T13:45:39Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101296/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101296/",
   "title": "CVE-2026-101296 fixed in openSUSE:Tumbleweed",
   "content_text": "Fixed versions: tomcat 9.0.123-1.1, tomcat10 10.1.61-1.1, tomcat11 11.0.27-1.1.",
   "date_published": "2026-10-20T13:45:39Z"
  }
 ]
}