Apache Tomcat Patches 12 Vulnerabilities, Including WebSocket and HTTP/2 Flaws
Apache Tomcat 11.0.26 has been released to fix 12 security vulnerabilities affecting WebSocket, HTTP/2, AJP, and authentication mechanisms, with several rated 'Important'.
The Apache Software Foundation has issued an urgent security update for its popular Tomcat web server, releasing version 11.0.26 to address a total of 12 vulnerabilities. These flaws span critical components including WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation, presenting a broad patching requirement for administrators of internet-facing Java application servers. The update, disclosed on September 23, 2026, includes four vulnerabilities rated 'Important,' three 'Moderate,' and five 'Low' in severity.
Most existing deployments of Tomcat 11 are potentially affected, with many issues impacting versions from 11.0.0-M1 through 11.0.25. Some narrower vulnerabilities begin affecting versions as recent as 11.0.22. Apache does not provide binary patches for individual vulnerabilities, necessitating the upgrade to 11.0.26 as the baseline for remediation. Administrators are advised to test application compatibility before deploying the update.
A headline vulnerability, CVE-2026-87022, is a critical flaw in the WebSocket implementation when per-message-deflate compression is enabled. Improper handling of a length parameter can allow an attacker to smuggle WebSocket messages, potentially leading to various security bypasses or denial-of-service conditions. This issue affects all releases from 11.0.0-M1 through 11.0.25.
Another significant concern is CVE-2026-86350, a regression in the HTTP/2 protocol handling that was introduced while fixing a previous vulnerability. This flaw can lead to inconsistent request interpretation, causing headers to be associated incorrectly and resulting in a request-header mix-up. Versions 11.0.22 through 11.0.25 are susceptible to this issue. Related HTTP/2 defects include CVE-2026-78437, where malformed requests can disrupt other users' requests, and CVE-2026-77762, a race condition that could allow the injection of trailer fields into recycled requests.
Denial-of-service (DoS) risks are also prominent in this release. CVE-2026-78383 can cause an AJP processing thread to become pinned when a request body is absent, consuming server resources. Additionally, CVE-2026-77791 allows for DoS through a busy wait loop while sending a WebSocket close message, and CVE-2026-79677, a concurrency bug, can cause asynchronous WebSocket write timeouts to be lost, leading to indefinite resource consumption.
The update also addresses an authorization bypass vulnerability in WebSockets, CVE-2026-76183, which occurs due to the parsing of request paths as endpoint templates. Furthermore, CVE-2026-75973 could lead to the reuse of the first application's authentication realm across multiple applications when using Jakarta Authentication's default SimpleAuthConfigProvider. Another issue, CVE-2026-77756, could allow the injection of unauthorized data by honoring Transfer-Encoding in HTTP/1.0 traffic behind a reverse proxy.
Security related to certificate validation has also been improved. CVE-2026-86248 corrects an incomplete fix for OCSP (Online Certificate Status Protocol) that could allow CLIENT_CERT authentication to succeed even when soft-fail was disabled in the FFM implementation. CVE-2026-73581 addresses behavior in OpenSSL and OpenSSL-FFM where certificate revocation lists might be ignored when certificates are stored in a keystore.
Administrators are urged to inventory all Tomcat 11 instances, prioritize external-facing connectors, and upgrade to version 11.0.26. They should also verify downloaded artifacts using Apache's provided signatures or checksums, review their reverse proxy and authentication configurations, and monitor for any unusual activity such as connection exhaustion or authorization failures. Given the nature of some vulnerabilities involving race conditions and shared connection states, thorough regression testing and sustained monitoring are crucial post-deployment.