Apache discloses ten Tomcat and Native security flaws

Apache published ten Tomcat and Tomcat Native advisories on 23 September 2026, mostly denial-of-service and authentication issues, with no exploitation reported.

On 23 September 2026, oss-security posts disclosed ten Apache Tomcat and Apache Tomcat Native vulnerabilities. Tomcat issues include important denial-of-service flaws CVE-2026-77791, a WebSocket close busy-wait, and CVE-2026-78383, an unauthenticated AJP request missing its body; moderate WebSocket timeout denial of service CVE-2026-79677; low-severity HTTP/2 incomplete cleanup CVE-2026-78437; moderate OCSP soft-fail CVE-2026-86248, an incomplete fix for CVE-2026-34500; important HTTP/2 header mix-up CVE-2026-86350, a regression of the CVE-2026-41293 fix; and low-severity WebSocket message smuggling CVE-2026-87022. Tomcat Native issues are important TLS-handshake buffer over-read CVE-2026-86243, moderate insecure OpenSSL defaults CVE-2026-86246, and moderate client-certificate downgrade race CVE-2026-86247, affecting 1.3.0–1.3.8 and 2.0.0–2.0.15, with unsupported releases possibly affected for some of them. Affected Tomcat ranges vary by CVE and commonly end at 11.0.25, 10.1.59, 9.0.121, 8.5.100, and 7.0.109; CVE-2026-78437 does not affect Tomcat through 8.5.100, and CVE-2026-79677 does not affect versions before 7.0.43. None of the notices report active exploitation. The reports do not disagree; each describes a separate flaw.