Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security
Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.
Apache released Tomcat 11.0.26 on September 23, 2026, fixing 12 vulnerabilities across WebSocket, HTTP/2, AJP, authentication, and TLS validation. Four are rated Important, three Moderate, and five Low; most affect 11.0.0-M1 through 11.0.25. CVE-2026-87022 can smuggle WebSocket messages when per-message-deflate is enabled, and CVE-2026-86350 can mix up HTTP/2 request headers. CVE-2026-76183 is an Important WebSocket authorization bypass. Apache advises upgrading to 11.0.26; no exploitation is reported.
- Tomcat 11.0.26 fixes 12 flaws: four Important, three Moderate, five Low.
- CVE-2026-87022 can smuggle WebSocket messages when per-message-deflate is enabled.
- CVE-2026-86350 mixes HTTP/2 headers after a regression of CVE-2026-41293.
- CVE-2026-76183 is an Important WebSocket authorization bypass via path templates.
- Apache ships no per-flaw binaries; 11.0.26 is the remediation baseline.
- CVEs
- CVE-2026-87022CVE-2026-86350CVE-2026-41293CVE-2026-78437CVE-2026-77762CVE-2026-78383CVE-2026-77791CVE-2026-79677CVE-2026-76183CVE-2026-75973CVE-2026-77756CVE-2026-86248CVE-2026-73581
- Vendors
- Apache Software Foundation
- Products
- Apache Tomcat
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41293 | Improper Input Validation vulnerability in Apache Tomcat | 9.8 | 2% | ||
| CVE-2026-76183 | Critical Authentication Bypass in Apache Tomcat WebSocket Endpoints | 9.8 group max | <1% | PoC | |
CVE-2026-79677+1 related CVE | WebSocket Async Write Timeout DoS in Apache Tomcat | 7.5 group max | — |
From the original article
2 min read at cybersecuritynews.com
Apache Software Foundation has released Tomcat 11. 0. 26 to address 12 security vulnerabilities spanning WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.