Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
Apache Tomcat 11.0.26, dated September 15, 2026, fixes 12 vulnerabilities that were publicly disclosed on September 23. CVE-2026-76183, rated Important, can bypass security constraints on WebSocket endpoints in every 11.0 build from 11.0.0-M1 through 11.0.25. The release also fixes WebSocket and AJP denial-of-service flaws, including CVE-2026-78383 and CVE-2026-77791, and an HTTP/2 request-header mix-up tracked as CVE-2026-86350. Apache does not ship binary patches and advises upgrading from 11.0.25 or earlier.
- Tomcat 11.0.26 fixes 12 flaws publicly disclosed on September 23, 2026.
- CVE-2026-76183 can bypass WebSocket endpoint security constraints.
- Important DoS bugs affect WebSocket close handling and AJP worker threads.
- CVE-2026-86350 mixes HTTP/2 request headers in versions 11.0.22 through 11.0.25.
- Apache provides no binary patches; administrators should upgrade to 11.0.26.
- CVEs
- CVE-2026-76183CVE-2026-87022CVE-2026-79677CVE-2026-77791CVE-2026-78383CVE-2026-41293CVE-2026-86350CVE-2026-86248CVE-2026-78437CVE-2026-77762CVE-2026-77756CVE-2026-75973CVE-2026-73581
- Vendors
- Apache
- Products
- Apache Tomcat
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41293 | Improper Input Validation vulnerability in Apache Tomcat | 9.8 | 2% | ||
| CVE-2026-76183 | Critical Authentication Bypass in Apache Tomcat WebSocket Endpoints | 9.8 group max | <1% | PoC | |
CVE-2026-79677+1 related CVE | WebSocket Async Write Timeout DoS in Apache Tomcat | 7.5 group max | — |
From the original article
2 min read at gbhackers.com
Apache Tomcat 11. 0. 26 has been released with fixes for 12 security vulnerabilities, including a significant flaw that could allow attackers to bypass security constraints protecting WebSocket endpoints.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.