Apache Tomcat: 12 Vulnerabilities Including HTTP/2 Smuggling and Auth Bypass Disclosed Together
Key findings • 12 Apache Tomcat vulnerabilities disclosed on September 23, 2026, affecting WebSocket, HTTP/2, AJP, authentication, and TLS. • Critical flaws include HTTP/2 request smuggling (…
Key findings
- 12 Apache Tomcat vulnerabilities disclosed on September 23, 2026, affecting WebSocket, HTTP/2, AJP, authentication, and TLS.
- Critical flaws include HTTP/2 request smuggling (CVE-2026-86350) and authentication bypasses (CVE-2026-86248, CVE-2026-76183).
- Multiple denial-of-service vulnerabilities impact WebSocket and AJP processing.
- Recommended upgrades are Tomcat 11.0.26, 10.1.60, and 9.0.122.
- Flaws affect a wide range of Tomcat versions from early development to recent releases.
On September 23, 2026, the Apache Software Foundation released a critical security update for its Tomcat application server, addressing a batch of 12 vulnerabilities disclosed on the same day. These flaws span various components, including WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation, posing a significant risk to internet-facing Java application servers. The update, with versions 11.0.26, 10.1.60, and 9.0.122 recommended for upgrade, aims to mitigate risks ranging from denial-of-service attacks to authentication bypasses.
Several vulnerabilities center around the handling of HTTP/2 requests and WebSocket messages. CVE-2026-86350, a critical flaw with a CVSS score of 9.1, arises from a regression in a previous fix, leading to HTTP request/response smuggling and header mix-ups. This affects Tomcat versions from 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.x. Similarly, CVE-2026-87022 (High, CVSS 7.5) involves improper handling of the length parameter in WebSocket messages when per-message-deflate is enabled, allowing for message smuggling. CVE-2026-77762 (High, CVSS 8.1) is a race condition vulnerability that allows an attacker to inject trailer fields into another HTTP/2 request. CVE-2026-77756 (Low, CVSS 3.7) also relates to HTTP request/response smuggling, specifically when processing the transfer-encoding header for HTTP/1.0 requests behind a reverse proxy.
Denial-of-service (DoS) vulnerabilities are also prominent in this batch. CVE-2026-78383 (High, CVSS 7.5) allows an unauthenticated AJP request to pin an AJP processing thread, leading to a DoS. CVE-2026-79677 (High, CVSS 7.5) involves a missing release of resources after effective lifetime for asynchronous WebSocket writes, also resulting in a DoS. Another DoS vulnerability, CVE-2026-77791 (High, CVSS 7.5), occurs during the sending of WebSocket close messages. CVE-2026-78437 (High, CVSS 7.3) is an incomplete cleanup vulnerability that could cause one user's request to fail due to a malformed request, dependent on timing.
Authentication and certificate validation flaws were also addressed. CVE-2026-86248 (Critical, CVSS 9.8) concerns a scenario where CLIENT_CERT authentication does not fail as expected when soft fail is disabled. CVE-2026-76183 (Critical, CVSS 9.8) bypasses security constraints for WebSocket endpoints. CVE-2026-75973 (High, CVSS 7.3) involves improper authentication when Jakarta Authentication is configured with SimpleAuthConfigProvider, potentially causing the wrong realm to be used across multiple web applications. Lastly, CVE-2026-73581 (Medium, CVSS 6.5) highlights an improper check for certificate revocation, where both OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when a certificate uses a keystore.
The Apache Software Foundation recommends upgrading to specific patched versions: 11.0.26, 10.1.60, and 9.0.122. These releases consolidate fixes for all 12 disclosed vulnerabilities. Administrators are urged to apply these updates promptly to protect their Tomcat instances from these diverse security risks. The broad impact across multiple versions underscores the importance of maintaining up-to-date deployments of the Tomcat application server. Cyber Security News