Tomcat discloses 11.0.27 security fixes: check request confusion and authentication settings against your configuration
Tomcat disclosed multiple security issues addressed in 11.0.27, including AJP and HTTP/2 request or response confusion and flaws in specific JNDIRealm authentication configurations. Distinguish the fixed-version release date from the vulnerability disclosure date.
Source Facts
Tomcat 11's security page dates 11.0.27 to 12 October, while the related vulnerabilities were disclosed on 20 October. The advisories describe possible response-content confusion during non-blocking AJP writes and an object recycling issue in asynchronous HTTP/2 handling. In some cases, these could affect data boundaries between users.
The same set of fixes also addresses JNDIRealm issues under specific non-GSSAPI SASL authentication mechanisms and flaws in other functions. Each advisory has its own scope and conditions. Organisations running other major Tomcat versions should consult advisories for their branch.
Validate application server updates alongside connector and authentication configuration. Do not apply version numbers from other branches directly to your system.
Original sources
Apache Tomcat 11 vulnerabilities — Fixed in Apache Tomcat 11.0.27
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationAmazon Linux updates its Docker security advisory: check container hosts and archive handling
IllustrationPHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause
Illustration