Login
Apache Tomcat Update: 12 Security Flaws Fixed in Tomcat 11.0.26
24 September 2026 at 04:59
Apache Tomcat Update-Who Needs It
Most Tomcat 11 deployments are exposed. Many of the issues affect versions 11.0.0-M1 through 11.0.25, while narrower flaws start at 11.0.0-M5, 11.0.0-M14, 11.0.19 or 11.0.22. Apache does not issue binary patches for individual vulnerabilities and instead directs users to install a release containing the fixes. That makes 11.0.26 the practical minimum for remediation.How CVE-2026-87022 Enables WebSocket Smuggling
CVE-2026-87022 comes from improper handling of a length parameter when per-message-deflate compression is enabled. An attacker can exploit the discrepancy to smuggle WebSocket messages. Every release from 11.0.0-M1 through 11.0.25 is affected, and the correction is in commit 4fef25fe.CVE-2026-86350 and Other HTTP/2 Defects
CVE-2026-86350 is the higher-priority HTTP/2 issue. It is a regression introduced during the fix for CVE-2026-41293. Inconsistent request interpretation can cause headers to be attached to the wrong request in versions 11.0.22 through 11.0.25. Two related HTTP/2 bugs were also fixed. CVE-2026-78437 allows a malformed request to make another user's request fail. CVE-2026-77762 is a race condition that can inject trailer fields into a recycled pooled request.Denial-of-Service and Authorization Risks
Several fixes address availability. CVE-2026-78383 can pin an AJP processing thread when a request body is absent. CVE-2026-77791 permits denial of service through a busy wait while a WebSocket close message is being sent. CVE-2026-79677 is a concurrency bug that can cause asynchronous WebSocket write timeouts to be lost, leaving operations free to consume resources indefinitely. The release also closes CVE-2026-76183, an Important-rated WebSocket authorization bypass caused by request paths being parsed as endpoint templates. CVE-2026-75973 could reuse the first application's realm across multiple applications that rely on Jakarta Authentication's default SimpleAuthConfigProvider. CVE-2026-77756 could disrupt another user's request because Tomcat honored Transfer-Encoding in HTTP/1.0 traffic behind a reverse proxy.Certificate Validation Repairs
Two fixes concern certificate checking. CVE-2026-86248 completes an earlier, incomplete OCSP fix. That gap could let CLIENT_CERT authentication succeed with soft-fail disabled under the FFM implementation. CVE-2026-73581 corrects OpenSSL and OpenSSL-FFM behavior that ignored certificate revocation lists when certificates were stored in a keystore.Rolling Out the Apache Tomcat Update Safely
Administrators are advised to take the following steps:- Inventory every Tomcat 11 instance.
- Prioritize externally reachable WebSocket, HTTP/2 and AJP connectors.
- Upgrade to 11.0.26 after testing application compatibility.
- Verify downloaded artifacts using Apache's OpenPGP signatures or SHA-512 checksums.
- Review reverse-proxy and authentication configurations.
- Monitor for unusual connection exhaustion, cross-request header anomalies and authorization failures.
