Do Son 
TL;DR
The Apache Software Foundation released version 11.0.26 to address 15 Apache Tomcat vulnerabilities. These flaws include high-impact Denial of Service (DoS) bugs, WebSocket smuggling, and security constraint bypasses. Administrators must update to the latest release to secure their servers.
- Total: 12 CVEs
- Severity: 3 Critical · 7 High · 1 Medium · 1 Low
- Actively exploited: None confirmed
- Highest severity: 9.8 (Critical · CVSSv3) — CVE-2026-86248
- Action: Apply the latest security updates now
Track every Apache CVE the moment it's exploited.
Get free email alertsNotable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-86248 | 9.8 | CWE-287 | — | Not exploited |
| CVE-2026-76183 | 9.8 | CWE-289 | 7.0.43 | Not exploited |
| CVE-2026-86350 | 9.1 | CWE-444 | — | Not exploited |
| CVE-2026-77762 | 8.1 | CWE-362 | — | Not exploited |
| CVE-2026-87022 | 7.5 | CWE-130 | — | Not exploited |
| CVE-2026-79677 | 7.5 | CWE-772 | — | Not exploited |
| CVE-2026-78383 | 7.5 | CWE-770 | — | Not exploited |
| CVE-2026-77791 | 7.5 | CWE-400 | — | Not exploited |
Why It Matters
Tomcat remains one of the most widely used Java servlet containers globally. Consequently, these Apache Tomcat vulnerabilities threaten enterprise web applications by exposing them to DoS attacks and request manipulation. The update addresses 15 security vulnerabilities in total, with several classified as “Important”. For example, CVE-2026-86350 involves an inconsistent interpretation of HTTP/2 requests caused by a previous regression. This error triggers request header mix-ups. Additionally, CVE-2026-78383 allows an attacker to pin an AJP processing thread by omitting a request body. This action leads to a direct DoS condition. Currently, security teams have confirmed no active exploitation in the wild. However, the public disclosure of these flaws requires immediate attention.
How The Attack Works
The patched flaws span multiple core components, including HTTP/2 processing, WebSockets, and AJP connectors. CVE-2026-87022, a WebSocket message smuggling flaw, occurs due to the improper handling of the length parameter when per-message-deflate is active. Furthermore, attackers can trigger a busy wait during the sending of a WebSocket close message. This mechanism leads to a DoS attack via CVE-2026-77791. Additionally, a race condition identified as CVE-2026-77762 enables an attacker to inject trailer fields into recycled pooled HTTP/2 requests. This injection relies on a stale HPACK emitter.
Affected Versions
These Apache Tomcat vulnerabilities primarily affect versions 11.0.0-M1 through 11.0.25. Certain flaws, like the HTTP/2 malformed request DoS (CVE-2026-78437), specifically impact versions 11.0.19 to 11.0.25.
Patch Or Mitigation Steps
Administrators must immediately apply the latest patches to safeguard their infrastructure. Upgrading to Tomcat 11.0.26 resolves all identified issues. For a complete list of technical fixes, review the official release notes detailing what was Fixed in Apache Tomcat 11.0.26. Finally, ensure that perimeter defenses drop malformed HTTP/1.0 requests carrying transfer-encoding headers to mitigate residual risks.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
