Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
Apache Tomcat 11.0.26, dated September 15, 2026, fixes 12 vulnerabilities that were publicly disclosed on September 23. CVE-2026-76183, rated Important, can bypass security constraints on WebSocket endpoints in every 11.0 build from 11.0.0-M1 through 11.0.25. The release also fixes WebSocket and AJP denial-of-service flaws, including CVE-2026-78383 and CVE-2026-77791, and an HTTP/2 request-header mix-up tracked as CVE-2026-86350. Apache does not ship binary patches and advises upgrading from 11.0.25 or earlier.
- Tomcat 11.0.26 fixes 12 flaws publicly disclosed on September 23, 2026.
- CVE-2026-76183 can bypass WebSocket endpoint security constraints.
- Important DoS bugs affect WebSocket close handling and AJP worker threads.
- CVE-2026-86350 mixes HTTP/2 request headers in versions 11.0.22 through 11.0.25.
- Apache provides no binary patches; administrators should upgrade to 11.0.26.
Vulnerabilities mentionedAll →
- CVE-2026-412939.82%Improper Input Validation vulnerability in Apache Tomcatpublished · apache tomcat
- CVE-2026-761839.8—Critical Authentication Bypass in Apache Tomcat WebSocket Endpointspublished · Apache Software Foundation Apache Tomcat
Full article493 words · extracted from gbhackers.com · click to collapse
Apache Tomcat 11.0.26 has been released with fixes for 12 security vulnerabilities, including a significant flaw that could allow attackers to bypass security constraints protecting WebSocket endpoints.
This release also addresses several denial-of-service (DoS) issues affecting WebSocket, AJP, HTTP/2, and HTTP/1.0 request handling.
Dated September 15, 2026, the release addresses flaws that were publicly disclosed on September 23. Administrators running Tomcat 11.0.25 or earlier should prioritize upgrading to version 11.0.26, especially if they are using WebSocket services, AJP connectors, HTTP/2, reverse proxies, Jakarta Authentication, or OpenSSL-based TLS.
Apache Tomcat 11.0.26
The most critical issue, tracked as CVE-2026-76183, involves a WebSocket endpoint security-constraint bypass. Tomcat incorrectly parsed request paths as endpoint templates, potentially allowing attackers to evade access controls set for WebSocket endpoints. This flaw affects all Tomcat 11 builds from version 11.0.0-M1 through 11.0.25 and was fixed in commit e182d86b.
Tomcat 11.0.26 also addresses CVE-2026-87022, a low-severity WebSocket message-smuggling vulnerability. Improper processing of a length parameter could enable message smuggling when the per-message-deflate WebSocket extension is active.
Three significant DoS issues have been resolved in this release. CVE-2026-79677 stems from a concurrency error that may cause asynchronous WebSocket write timeouts to be lost, allowing an attacker to disrupt service. CVE-2026-77791 could enable DoS through a busy-wait condition while sending a WebSocket close message.
CVE-2026-78383 affects AJP deployments: a request without a body could lock an AJP processing thread, potentially exhausting available worker threads. Organizations that do not require AJP should turn off the connector or make it inaccessible from untrusted networks.
Additionally, the release corrects defects in HTTP/2, including a request-header mix-up regression from the earlier fix for CVE-2026-41293, tracked as CVE-2026-86350. The affected range is narrower, versions 11.0.22 through 11.0.25, but the issue is rated important.
Upgrade directly to Apache Tomcat 11.0.26 after validating application compatibility. Security teams should also review WebSocket endpoint constraints, inspect AJP exposure, restrict proxy-to-Tomcat traffic, and verify certificate-revocation behavior where OpenSSL or OpenSSL-FFM connectors rely on keystore-backed certificates.
Apache does not provide binary patches; users needing source-level remediation must rebuild using Tomcat’s published build instructions.
CVE Details
| CVE | Severity | Affected versions | Technical impact |
|---|---|---|---|
| CVE-2026-87022 | Low | 11.0.0-M1–11.0.25 | WebSocket message smuggling with per-message-deflate |
| CVE-2026-86350 | Important | 11.0.22–11.0.25 | HTTP/2 request-header mix-up |
| CVE-2026-86248 | Moderate | 11.0.0-M14–11.0.25 | OCSP checks may soft-fail despite configuration |
| CVE-2026-79677 | Moderate | 11.0.0-M1–11.0.25 | WebSocket asynchronous-write timeout DoS |
| CVE-2026-78437 | Low | 11.0.19–11.0.25 | Malformed HTTP/2 request may disrupt another request |
| CVE-2026-78383 | Important | 11.0.0-M1–11.0.25 | AJP thread-pinning DoS |
| CVE-2026-77791 | Important | 11.0.0-M5–11.0.25 | Busy-wait WebSocket-close DoS |
| CVE-2026-77762 | Low | 11.0.0-M1–11.0.25 | HTTP/2 trailer injection through request recycling |
| CVE-2026-77756 | Low | 11.0.0-M1–11.0.25 | Reverse-proxy request disruption via HTTP/1.0 transfer encoding |
| CVE-2026-76183 | Important | 11.0.0-M1–11.0.25 | WebSocket endpoint security-constraint bypass |
| CVE-2026-75973 | Low | 11.0.0-M1–11.0.25 | Cross-context Jakarta Authentication realm mix-up |
| CVE-2026-73581 | Moderate | 11.0.0-M1–11.0.25 | CRLs ignored by OpenSSL and OpenSSL-FFM TLS paths using keystores |
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.