Apache Tomcat Fixes Eight Flaws Enabling Authentication Bypass and Cross-User Data Exposure

Apache disclosed eight Tomcat vulnerabilities and released fixes in versions 11.0.27, 10.1.61, and 9.0.123. Three flaws rated Important can allow a configuration-dependent JNDIRealm authentication bypass, HTTP/2 request and response mixing between users, and AJP response mixing that could expose information or disrupt requests. Five Low-severity flaws affect HTTP/2 trailer cleanup, TLS 1.3 connections, Jasper redirect processing, FIPS-mode enforcement, and APR Unix domain socket permissions. Exposure depends on the release branch and enabled features; Apache’s notices do not report active exploitation.

A related Atlassian advisory flags a Tomcat dependency vulnerability in Confluence Data Center, describing a Unix domain socket permissions race that permits unauthorized local access. Atlassian rates the issue High, with CVSS 8.1, and recommends the latest release or fixed versions 11.0.0, 10.2.19, or 9.2.26 within the corresponding release line. The underlying socket issue had earlier Tomcat fixes in 11.0.25, 10.1.58, and 9.0.121. Atlassian’s network-based, unauthenticated attack characterization conflicts with the included Tomcat description of local access, leaving the attack prerequisites unresolved. Administrators should inventory affected standalone and embedded Tomcat deployments, verify exposed features, and apply the appropriate Tomcat or Confluence updates.