Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
68
CVE-2026-76183
Critical Authentication Bypass in Apache Tomcat WebSocket Endpoints
- CVSS 3.1
- 9.8 critical
- EPSS
- <1%p47
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-76183 is a critical authentication bypass vulnerability in Apache Tomcat that allows an attacker to bypass security constraints for any configured WebSocket endpoint. The flaw is triggered by making requests using alternate, malformed hostnames that the server accepts but do not match the intended security constraints. A successful attack grants unauthorized access to protected WebSocket resources without authentication, potentially leading to data exposure or manipulation. This issue affects a wide range of supported and older, unsupported Tomcat versions. As of this analysis, there are no known public exploits or reports of in-the-wild exploitation.
What to do: Upgrade to Apache Tomcat 11.0.26, 10.1.60, or 9.0.122 immediately. For older, unsupported versions (8.5.x, 7.0.x), upgrade to a supported release. There is no other mitigation for this authentication bypass.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache Tomcat | from 11.0.0-M1 through 11.0.25 |
| Apache Software Foundation Apache Tomcat | from 10.1.0-M1 through 10.1.59 |
| Apache Software Foundation Apache Tomcat | from 9.0.0.M1 through 9.0.121 |
| Apache Software Foundation Apache Tomcat | from 8.5.0 through 8.5.100 (End-of-Support) |
| Apache Software Foundation Apache Tomcat | from 7.0.43 through 7.0.109 (End-of-Support) |
Estimated exposure
massUnknown, but likely a large proportion of the estimated 700k+ public Tomcat servers — Based on the ubiquity of Apache Tomcat as a core internet server and application container, public scan data indicates hundreds of thousands of exposed instances across multiple major versions.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
- Weakness
- CWE-289
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
3 storiesApache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security
Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.
68
CVE-2026-76183: Apache Tomcat: Bypass of security constraints for WebSocket endpoints
Apache Tomcat CVE-2026-76183 lets attackers bypass security constraints on any WebSocket endpoint.
68