Apache discloses 10 CVEs across Tomcat and Tomcat Native: WebSocket security bypass, HTTP/2 header mix-up, and TLS flaws

Ten advisories posted to oss-security on 2026-09-23 cover seven Apache Tomcat CVEs (WebSocket security-constraint bypass, WebSocket and AJP DoS, CRL/OCSP revocation gaps, HTTP/2 request-header mix-up) and three Apache Tomcat Native CVEs (TLS-handshake JVM…

Between 16:28 and 16:59 UTC on 2026-09-23, oss-security carried ten coordinated Apache security advisories: seven for Apache Tomcat and three for Apache Tomcat Native. The important-rated issues are CVE-2026-76183 (bypass of security constraints on any WebSocket endpoint), CVE-2026-77791 (busy-wait denial of service when sending a WebSocket close message), CVE-2026-78383 (an unauthenticated AJP request missing its body pins an AJP processing thread via unbounded resource allocation), CVE-2026-86350 (a regression in the fix for CVE-2026-41293 causing HTTP/2 request-header mix-up), and CVE-2026-86243 (a Tomcat Native buffer over-read during the TLS handshake that can crash the JVM). The moderate-rated issues are CVE-2026-73581 (OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when the certificate is loaded from a keystore), CVE-2026-79677 (a lost asynchronous WebSocket write timeout leaves a resource unreleased past its effective lifetime), CVE-2026-86248 (an incomplete fix for CVE-2026-34500 in which OCSP checks can soft-fail via the FFM path even when soft-fail is disabled, so CLIENT_CERT authentication may not fail as expected), CVE-2026-86246 (Tomcat Native initializes TLS with insecure OpenSSL defaults including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX), and CVE-2026-86247 (a race condition that can downgrade client-certificate verification requirements). Most Tomcat CVEs share upper bounds of 11.0.25, 10.1.59, 9.0.121, and 8.5.100, with several DoS and bypass issues extending down through 7.0.x; the two revocation follow-ups and the HTTP/2 regression affect only recent releases. The three Tomcat Native CVEs affect 1.3.0-1.3.8 and 2.0.0-2.0.15, with unsupported earlier versions possibly affected. Mark Thomas is the named discloser on five of the ten advisories. No advisory reports exploitation in the wild, and the posts do not state fixed version numbers. The reports do not conflict with one another; their affected-version ranges simply differ per CVE.