Amazon Linux 2 Security Advisory: ALAS2-2026-3864
Advisory Released Date: 2026-08-17
Advisory Updated Date: 2026-08-17
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue. (CVE-2026-55957)
Affected Packages:
tomcat
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update tomcat or yum update --advisory ALAS2-2026-3864 to update your system.
noarch:
tomcat-7.0.76-10.amzn2.0.17.noarch
tomcat-admin-webapps-7.0.76-10.amzn2.0.17.noarch
tomcat-docs-webapp-7.0.76-10.amzn2.0.17.noarch
tomcat-javadoc-7.0.76-10.amzn2.0.17.noarch
tomcat-jsvc-7.0.76-10.amzn2.0.17.noarch
tomcat-jsp-2.2-api-7.0.76-10.amzn2.0.17.noarch
tomcat-lib-7.0.76-10.amzn2.0.17.noarch
tomcat-servlet-3.0-api-7.0.76-10.amzn2.0.17.noarch
tomcat-el-2.2-api-7.0.76-10.amzn2.0.17.noarch
tomcat-webapps-7.0.76-10.amzn2.0.17.noarch
src:
tomcat-7.0.76-10.amzn2.0.17.src