Apache Tomcat Patches Dozen Vulnerabilities, Including Access Control Bypass and DoS Flaws
Apache Tomcat 11.0.25 addresses critical vulnerabilities allowing security bypass and server crashes, urging immediate upgrades for affected users.
The Apache Software Foundation has released version 11.0.25 of its widely-used Apache Tomcat Java servlet container, patching a total of twelve security vulnerabilities. These flaws, disclosed on August 25, 2026, range in severity from low-impact issues to critical bugs that could permit attackers to bypass security controls or cause denial-of-service conditions, potentially leading to server outages. Organizations utilizing Tomcat versions 11.0.0-M1 through 11.0.24 are strongly advised to prioritize this update.
A significant portion of the patched vulnerabilities targets Tomcat's authorization and authentication mechanisms. CVE-2026-65182, rated as 'important,' allows for security constraint bypass if a broader URL path rule is configured before a more specific sub-path rule. This could expose protected resources to unauthorized access. Another important flaw, CVE-2026-68569, affects authentication methods like CLIENT-CERT and SPNEGO, potentially allowing unverified users to authenticate if they are not present in the DataSourceRealm. Furthermore, CVE-2026-65927, stemming from an off-by-one error in the RewriteValve component, could enable access control bypass through crafted rewrite rules by causing rule processing to restart incorrectly.
Additional vulnerabilities related to access control include CVE-2026-68525, where FORM-based authentication redirects could circumvent method-specific security constraints, allowing GET requests to access resources intended only for POST. CVE-2026-66422 involves the misapplication of servlet role-reference definitions as realm-level role aliases, deviating from their intended use with Request.isUserInRole(). These issues collectively weaken the integrity of access control within Tomcat deployments.
Beyond access control, several vulnerabilities in Tomcat's HTTP/2 and WebSocket implementations pose a risk of server crashes. CVE-2026-68763, an important-rated bug, introduces a denial-of-service condition through an allocation leak in HTTP/2 backlog tracking, exploitable by resetting streams. Similarly, CVE-2026-66299, found in the bundled WebSocket chat example, could lead to resource exhaustion and server failure when a deliberately slow client interacts with an unbounded message buffer. Administrators who have removed example applications are not affected by this specific flaw.
Other notable fixes include CVE-2026-65637, which addresses an incomplete patch for a previous HTTP/2 SNI validation issue, allowing a no-authority bypass. CVE-2026-65183 corrects a time-of-check-to-time-of-use race condition on Unix Domain Sockets, preventing unauthorized local access. A limited replay attack vector in DIGEST authentication, CVE-2026-65905, has also been closed.
Rounding out the disclosures are CVE-2026-73180, where authenticated WebSocket sessions could improperly persist after an HTTP session ends, and a related issue impacting session ID changes. The Apache Tomcat team has provided specific fixes for each vulnerability, and the recommended mitigation is to upgrade to version 11.0.25 immediately. The combination of access control bypasses and denial-of-service capabilities makes these vulnerabilities a significant threat, especially for internet-facing applications, underscoring the need for prompt patching to prevent potential data exposure and service disruptions.