trydabble
All security updates

Patchpad / Java (Tomcat, Spring, JDK)

How to check your Tomcat, Spring and Java versions

Last verified (KST)

Java sites usually stack three layers: the JDK, a server (Tomcat, often built into Spring Boot) and the framework. Each layer has its own fixes and its own version number, so check each one.

This page doesn't scan any site. It explains how to check your own.

What happened

Apache Tomcat: Tomcat 11 (11.0.27) fixed seven issues, three rated Important: an AJP response mix-up, an HTTP/2 response mix-up, and a directory sign-in check (JNDIRealm) that could let through a sign-in it should refuse. The AJP issue affects Tomcat 11 only. Tomcat 10.1 (10.1.61) has two Important and four Low; Tomcat 9.0 (9.0.123) has two Important and five Low. On both, the two Important ones are the HTTP/2 and JNDIRealm issues. tomcat.apache.org

Oracle Java SE: Oracle's quarterly Java update. OpenJDK builds from other vendors follow their own release notes. docs.oracle.com

Spring Framework: A low-rated issue where server-sent event streams in functional MVC can be corrupted under narrow conditions. spring.io

Recent advisories

If your version starts with the number on the left, you need the one on the right or later.

AdvisoryRating (vendor)Fixed in
Apache Tomcat 11.0.27, 10.1.61 and 9.0.123CVE-2026-103119, CVE-2026-101356, CVE-2026-101296Vendor advisorytomcat.apache.orgAlso: Apache Tomcat 10 security page, Apache Tomcat 9 security pagePublished2026-10-20Last verified2026-10-22 (KST)Rating (vendor)

Important

11.0: 3 Important, 4 Low · 10.1: 2 Important, 4 Low · 9.0: 2 Important, 5 Low

Fixed in
  • 11.0:11.0.27or later
  • 10.1:10.1.61or later
  • 9.0:9.0.123or later

Released 2026-10-12, made public 2026-10-20. The AJP issue (CVE-2026-103119) affects Tomcat 11 only.

Oracle Java SE October 2026 Critical Patch UpdateVendor advisorydocs.oracle.comAlso: Oracle Critical Patch Update, October 2026Published2026-10-20Last verified2026-10-22 (KST)Rating (vendor)

See vendor page

Rated in Oracle's risk matrix

Fixed in
  • 27:27.0.1or later
  • 25:25.0.5or later
  • 21:21.0.13or later
  • 17:17.0.21or later
  • 11:11.0.33or later
  • 8:8u511or later
Apache Tomcat 11.0.26, 10.1.60 and 9.0.122CVE-2026-76183Fixes including a WebSocket security-constraint bypass. The October releases include them too.Vendor advisorytomcat.apache.orgPublished2026-09-23Last verified2026-10-22 (KST)Rating (vendor)

Important

Fixed in
  • 11.0:11.0.26or later
  • 10.1:10.1.60or later
  • 9.0:9.0.122or later

Released 2026-09-15, made public 2026-09-23.

Spring Framework CVE-2026-59313CVE-2026-59313Vendor advisoryspring.ioPublished2026-08-20Last verified2026-10-22 (KST)Rating (vendor)

Low

Fixed in
  • 7.0:7.0.9or later

7.0.8.1, 6.2.20, 6.1.29, 6.0.31 and 5.3.50 are available only through Enterprise Support.

Apache Tomcat CVE-2025-24813CVE-2025-24813Applies only if writes are enabled for the default servlet, which is off by default.Vendor advisorytomcat.apache.orgPublished2025-03-10Last verified2026-10-22 (KST)Rating (vendor)

Important

Fixed in
  • 11.0:11.0.3or later
  • 10.1:10.1.35or later
  • 9.0:9.0.99or later

How to check your version

Hosting panel

  • Hosting platform: the Java or runtime setting shows the JDK version, and sometimes the Tomcat version.

Admin screen or project files

  • Spring Boot apps: look at the spring-boot-starter-parent or BOM version in pom.xml or build.gradle. The built-in Tomcat version shows in the dependency tree (Gradle: gradle dependencies).

    mvn dependency:tree

Command line

  • For the JDK, run this on the server.

    java -version

  • Standalone Tomcat: run the version script in Tomcat's bin folder (version.bat on Windows). github.com

    $CATALINA_HOME/bin/version.sh

How to update

Your host or platform runs it

  • Hosting platforms: pick the fixed JDK or Tomcat version in the runtime setting and redeploy.

You run the server

  • Tomcat: download and install the fixed release. Tomcat publishes no binary patches; its advice is to upgrade to a version where the issue is fixed. tomcat.apache.org

  • Spring Boot: move to a newer Spring Boot version, or set the tomcat.version property to a fixed Tomcat release.

  • JDK: update through your JDK vendor's channel. OpenJDK builds from other vendors (Temurin, Corretto and others) follow their own release notes, so check your vendor instead of guessing a number.

  • Tomcat 8.5 and 10.0 have reached end of life and get no fixes; plan a move to 9.0, 10.1 or 11.0.

If you can't update yet

Apache Tomcat: Apache Tomcat 11.0.27, 10.1.61 and 9.0.123

Tomcat lists each entry's own conditions on its security page. For these entries, Tomcat's advice is to upgrade. tomcat.apache.org

Spring Framework: Spring Framework CVE-2026-59313

Spring's advice is to upgrade to the fixed version; it adds: “No further mitigation steps are necessary.” spring.io

Apache Tomcat: Apache Tomcat CVE-2025-24813

Tomcat's condition: it applies only when writes are enabled for the default servlet (off by default). If nobody turned that on, this entry does not apply, and updating covers it anyway. tomcat.apache.org

What to ask your host

Copy this, fill in the brackets and send it through your host's support channel.

Hello, my Java app [app name] runs on your platform. Could you tell me the JDK version and the Apache Tomcat version it uses? Tomcat fixed issues in 11.0.27, 10.1.61 and 9.0.123 (made public on 20 October 2026), and Oracle's October 2026 update includes 21.0.13 and 17.0.21 among others. Is my runtime on a fixed release, and how do I update it? Thank you.

Vendor sources

Last verified (KST)