Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks

Apache Tomcat 11.0.26 has been released with fixes for 12 security vulnerabilities, including a significant flaw that could allow attackers to bypass security constraints protecting WebSocket endpoints.

This release also addresses several denial-of-service (DoS) issues affecting WebSocket, AJP, HTTP/2, and HTTP/1.0 request handling.

Dated September 15, 2026, the release addresses flaws that were publicly disclosed on September 23. Administrators running Tomcat 11.0.25 or earlier should prioritize upgrading to version 11.0.26, especially if they are using WebSocket services, AJP connectors, HTTP/2, reverse proxies, Jakarta Authentication, or OpenSSL-based TLS.

Apache Tomcat 11.0.26

The most critical issue, tracked as CVE-2026-76183, involves a WebSocket endpoint security-constraint bypass. Tomcat incorrectly parsed request paths as endpoint templates, potentially allowing attackers to evade access controls set for WebSocket endpoints. This flaw affects all Tomcat 11 builds from version 11.0.0-M1 through 11.0.25 and was fixed in commit e182d86b.

Tomcat 11.0.26 also addresses CVE-2026-87022, a low-severity WebSocket message-smuggling vulnerability. Improper processing of a length parameter could enable message smuggling when the per-message-deflate WebSocket extension is active.

Three significant DoS issues have been resolved in this release. CVE-2026-79677 stems from a concurrency error that may cause asynchronous WebSocket write timeouts to be lost, allowing an attacker to disrupt service. CVE-2026-77791 could enable DoS through a busy-wait condition while sending a WebSocket close message.

CVE-2026-78383 affects AJP deployments: a request without a body could lock an AJP processing thread, potentially exhausting available worker threads. Organizations that do not require AJP should turn off the connector or make it inaccessible from untrusted networks.

Additionally, the release corrects defects in HTTP/2, including a request-header mix-up regression from the earlier fix for CVE-2026-41293, tracked as CVE-2026-86350. The affected range is narrower, versions 11.0.22 through 11.0.25, but the issue is rated important.

Upgrade directly to Apache Tomcat 11.0.26 after validating application compatibility. Security teams should also review WebSocket endpoint constraints, inspect AJP exposure, restrict proxy-to-Tomcat traffic, and verify certificate-revocation behavior where OpenSSL or OpenSSL-FFM connectors rely on keystore-backed certificates.

Apache does not provide binary patches; users needing source-level remediation must rebuild using Tomcat’s published build instructions.

CVE Details

CVE	Severity	Affected versions	Technical impact
CVE-2026-87022	Low	11.0.0-M1–11.0.25	WebSocket message smuggling with per-message-deflate
CVE-2026-86350	Important	11.0.22–11.0.25	HTTP/2 request-header mix-up
CVE-2026-86248	Moderate	11.0.0-M14–11.0.25	OCSP checks may soft-fail despite configuration
CVE-2026-79677	Moderate	11.0.0-M1–11.0.25	WebSocket asynchronous-write timeout DoS
CVE-2026-78437	Low	11.0.19–11.0.25	Malformed HTTP/2 request may disrupt another request
CVE-2026-78383	Important	11.0.0-M1–11.0.25	AJP thread-pinning DoS
CVE-2026-77791	Important	11.0.0-M5–11.0.25	Busy-wait WebSocket-close DoS
CVE-2026-77762	Low	11.0.0-M1–11.0.25	HTTP/2 trailer injection through request recycling
CVE-2026-77756	Low	11.0.0-M1–11.0.25	Reverse-proxy request disruption via HTTP/1.0 transfer encoding
CVE-2026-76183	Important	11.0.0-M1–11.0.25	WebSocket endpoint security-constraint bypass
CVE-2026-75973	Low	11.0.0-M1–11.0.25	Cross-context Jakarta Authentication realm mix-up
CVE-2026-73581	Moderate	11.0.0-M1–11.0.25	CRLs ignored by OpenSSL and OpenSSL-FFM TLS paths using keystores

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC