Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
68
Vulnerability7 · 3 reads
CVE-2026-87022
WebSocket Message Smuggling in Apache Tomcat via per-message-deflate
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-87022 is a high-severity vulnerability in Apache Tomcat that allows WebSocket message smuggling when the 'per-message-deflate' compression extension is enabled. The flaw is due to improper handling of a length parameter, enabling an attacker to send a crafted WebSocket message that violates protocol expectations. This can lead to smuggling attacks, potentially causing request/response confusion and integrity violations between a front-end proxy and the Tomcat backend. The vulnerability affects a wide range of Tomcat versions across multiple major release lines. No public proof-of-concept exploit code is known to exist, and it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
What to do: Upgrade Apache Tomcat to the fixed versions: 11.0.26, 10.1.60, or 9.1.22. If upgrading immediately is not possible, disable the 'per-message-deflate' extension in your WebSocket configuration. Check application logs for suspicious WebSocket traffic patterns.
| Product | Affected |
|---|---|
| Apache Tomcat | 11.0.0-M1 through 11.0.25 |
| Apache Tomcat | 10.1.0-M1 through 10.1.59 |
| Apache Tomcat | 9.0.0.M1 through 9.0.121 |
| Apache Tomcat | 8.5.0 through 8.5.100 (EOS) |
| Apache Tomcat | 7.0.56 through 7.0.109 (EOS) |
Estimated exposure
massmillions of servers — Apache Tomcat is one of the most widely deployed web servers and servlet containers, with millions of internet-facing installations globally.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue.
- Weakness
- CWE-130
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
In the news
3 storiesApache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security
Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.
68
CVE-2026-87022: Apache Tomcat: WebSocket message smuggling with per-message-deflate
Apache Tomcat can smuggle WebSocket messages when per-message-deflate length handling is inconsistent.
34