AI-Accelerated Vulnerability Wave Hits Java: Oracle JDK Cert Trust & Tomcat Async Flaws Demand Urgent Patches

AI Puts Attack/Defense Rhythm into Overdrive

The past week saw a cascade of critical alerts across PHP (php2shell), GitLab, Node.js, and Chrome. The common accelerant is AI: both white-hat researchers and attackers now run large models and automated auditing tools against low-level open-source libraries. State-machine boundary defects that once took senior experts months to uncover are now surfacing in batches via scripted scans.

Weaponization time has collapsed. Where disclosure previously gave defenders two to three days to patch, AI-generated exploit scripts now drive network-wide scanning and exploitation attempts within an hour. Traditional manual inspections and weekly release cadences cannot keep pace with this automated tempo.

Oracle Revokes CA Trust (CVE-2026-91403)

Oracle issued an emergency advisory for CVE-2026-91403 (CVSS 3.1 9.1) affecting the JSSE component. The flaw lies in the digital certificate trust chain: Oracle forcibly revoked trust in a set of eMudhra-associated intermediate CA certificates. In TLS/HTTPS microservice environments, JSSE handles handshake and certificate validation; a compromised trust chain lets attackers forge certificates and perform man-in-the-middle attacks, bypassing service-to-service identity checks.

Affected versions span Oracle Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1, and GraalVM. No workaround exists — the only fix is a full JDK upgrade to the patched releases.

Tomcat Async Streaming Confusion (CVE-2026-101356)

Apache Tomcat disclosed multiple defects, the most severe being CVE-2026-101356 (CVSS 9.1). The bug resides in HTTP/2 combined with asynchronous Servlet processing. When an async request throws an exception or hits a network error, Tomcat's internal object recycling fails to fully clear the previous request's underlying objects before reusing them for a subsequent user's request.

This causes request/response confusion: user A's order query or authentication data can be returned to user B's session. In modern front-end/back-end separated architectures with long-lived multiplexed connections, sensitive tokens and private data leaking across channels is a critical breach.

Tomcat and Spring Boot Remediation Steps

Standalone Tomcat Upgrades

Tomcat 11 → 11.0.27+

Tomcat 10 → 10.1.61+

Tomcat 9 → 9.0.123+ (note: Tomcat 9 is nearing end-of-life; plan migration)

Spring Boot Projects

Spring Boot 4.1.2 was released today with the fixed Tomcat versions bundled. Upgrading to 4.1.2 is the cleanest path.

Emergency Version Pin (Maven)

If a full Spring Boot upgrade is blocked by a release freeze, override the Tomcat version in pom.xml:

<properties>
  <tomcat.version>10.1.61</tomcat.version>
</properties>

Emergency Version Pin (Gradle)

ext['tomcat.version'] = '10.1.61'

After changing the version, rebuild and inspect the dependency tree (e.g., mvn dependency:tree) to confirm tomcat-embed-core and related JARs resolve to the patched release. Simultaneously verify the host JDK and base Docker images are upgraded to the fixed JDK versions; both layers must be patched to close the vulnerability window.