Apache Tomcat Patches 11 Vulnerabilities in 11.0.25 Update

TL;DR

The Apache Tomcat team fixed 11 vulnerabilities on August 25, 2026. The batch includes three Important flaws, spanning authentication bypass, a security constraint bypass, and an HTTP/2 denial of service. Update to 11.0.25, 10.1.58, or 9.0.121 now.

Notable CVEs

Why This Apache Tomcat Vulnerability Batch Matters

Apache Tomcat serves Java web apps across millions of servers worldwide. A flaw here can expose enterprise systems at scale. This Apache Tomcat vulnerability set touches authentication, access control, and availability.

None of the eleven bugs reach Critical severity. Still, three rank as Important. Because several enable auth or constraint bypass, exposed servers face real risk.

How the Attacks Work

Authentication and Access Bypass

The most notable flaw is CVE-2026-68569, an Important authentication bypass. For methods like CLIENT-CERT and SPNEGO, Tomcat could authenticate a user who did not exist in the DataSourceRealm. In effect, the principal lookup could fail open.

A second Important bug, CVE-2026-65182, allows a security constraint bypass. It triggers when a longer path constraint precedes a stricter sub-path rule. Consequently, access controls can be skipped.

Denial of Service

The third Important flaw, CVE-2026-68763, sits in HTTP/2 backlog tracking. An allocation leak on a reset stream can be pushed toward denial of service. Other Low-severity bugs affect DIGEST replay, rewrite valves, and Unix domain socket permissions.

Is It Being Exploited?

No exploitation in the wild has been confirmed. The advisory reports no active attacks. Likewise, no public proof-of-concept exists yet.

Affected Versions

The flaws affect Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120. End-of-life 8.5 and 7.0 branches are also known to be affected. Versions before 7.0.43 are not affected.

Patch and Mitigation Steps

Upgrade to Apache Tomcat 11.0.25, 10.1.58, or 9.0.121 now. The full details appear in the Apache Tomcat 11.0.25 security advisory. If you removed the bundled examples web app, the chat-example DoS bug does not affect you.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.