Critical-Severity Vulnerability in Apache Tomcat; Fixed Versions Released for v9 / v10 / v11 Branches

What happened

On October 20, the Apache Software Foundation (ASF) said that Apache Tomcat has 8 security weaknesses, called vulnerabilities. They affect the v9, v10, and v11 release lines. Depending on the scoring system (CVSS 3.1 or 4.0), some are rated CRITICAL, with a top score of 9.1. The fixed versions are Tomcat v9.0.123, v10.1.61, and v11.0.27, released on October 12.

Key numbers and facts

• 8 vulnerabilities in total
• 3 are rated CRITICAL under CVSS (score 9.1): CVE-2026-101356, CVE-2026-101296, and CVE-2026-103119
• Fixed versions: v9.0.123, v10.1.61, v11.0.27 (released October 12)
• The v9.0 line will reach end of support on March 31, 2027

Some terms explained

Apache Tomcat is free software that runs websites and web apps. A vulnerability is a weak spot in software that someone could use to attack a system. CVE numbers are unique IDs given to each known weakness. CVSS is a score from 0 to 10 that shows how serious a weakness is. ASF uses its own rating too, so the two ratings can differ.

Why it matters

Tomcat runs many websites and apps, so a serious flaw could let attackers take control of a server. Users should update to the fixed versions as soon as possible. Those still on v9.0 should also plan to move to a newer version before support ends.

What to watch

• Check which Tomcat version you use and whether it is in the affected range
• Update to v9.0.123, v10.1.61, or v11.0.27 or later
• Plan an upgrade before v9.0 support ends on March 31, 2027