Apache Tomcat Flaws Let Attackers Bypass Authentication and Security Controls, Trigger DoS Attacks

Apache has released version 11.0.25 of Apache Tomcat to address ten security vulnerabilities, including multiple flaws that could lead to authentication bypasses, access-control evasion, and denial-of-service (DoS) conditions.

The most serious issues affect Tomcat’s processing of security constraints, authentication mechanisms, HTTP/2 implementation, and behavior of the RewriteValve.

All ten vulnerabilities impact releases of Apache Tomcat 11, with most affecting versions from 11.0.0-M1 through 11.0.24. Organizations running these affected versions should prioritize upgrading to version 11.0.25.

Apache Tomcat Flaws

One significant vulnerability, tracked as CVE-2026-65182, relates to how Tomcat processes security constraints. A security restriction could be bypassed when a longer-path constraint appears before a more restrictive constraint that covers a shorter sub-path.

This could expose protected web application resources that rely on declarative URL-based access policies.

Another important issue, CVE-2026-68569, may cause principal lookups to fail open in DataSourceRealm configurations. With certain authentication methods, including CLIENT-CERT and SPNEGO, Tomcat might treat a user as authenticated even if that user does not exist in the configured DataSourceRealm.

Apache also fixed CVE-2026-65927, an off-by-one error in the RewriteValve’s handling of the [N] flag. This error caused rewrite processing to restart at the second rule rather than the first, potentially allowing attackers to bypass access controls implemented through rewrite rules.

CVE-2026-68763 is a significant HTTP/2 vulnerability caused by a backlog-tracking allocation leak when a stream is reset. An attacker could exploit this flaw to consume resources and trigger a denial-of-service condition.

Additionally, Tomcat’s bundled WebSocket chat example is affected by CVE-2026-66299. The example application utilized an unbounded buffer for undelivered messages, allowing a deliberately slow client to force continuous memory growth until the Tomcat process exhausts its memory and fails. Deployments that have followed Apache’s security guidance by removing example web applications are not affected.

The update also addresses a moderate HTTP/2 issue, CVE-2026-65637, which represents an incomplete fix for CVE-2026-32990. This vulnerability could bypass strict Server Name Indication (SNI) validation when an HTTP/2 request lacks an authority value.

CVE Details

CVE	Severity	Vulnerability	Affected Versions
CVE-2026-73180	Low	Authenticated WebSocket session remains active after associated HTTP session ends following session-ID change	11.0.0-M1 to 11.0.24
CVE-2026-68763	Important	HTTP/2 backlog-tracking allocation leak enables DoS when streams are reset	11.0.0-M1 to 11.0.24
CVE-2026-68569	Important	DataSourceRealm principal lookup may fail open for CLIENT-CERT and SPNEGO authentication	11.0.0-M1 to 11.0.24
CVE-2026-68525	Low	FORM authentication redirect may bypass POST-specific security constraints	11.0.0-M1 to 11.0.24
CVE-2026-66422	Low	security-role-ref definitions may bypass declarative role constraints	11.0.0-M1 to 11.0.24
CVE-2026-66299	Low	Unbounded WebSocket chat-example buffer permits memory-exhaustion DoS	11.0.0-M20 to 11.0.24
CVE-2026-65927	Important	RewriteValve [N] processing error may bypass access-control rules	11.0.0-M1 to 11.0.24
CVE-2026-65905	Low	Limited one-time replay attack against DIGEST authentication requests	11.0.0-M1 to 11.0.24
CVE-2026-65637	Moderate	HTTP/2 no-authority requests may bypass strict SNI validation	11.0.20 to 11.0.24
CVE-2026-65183	Low	Unix Domain Socket creation race condition enables unauthorized local access	11.0.0-M1 to 11.0.24
CVE-2026-65182	Important	Security-constraint ordering flaw enables access-control bypass	11.0.0-M1 to 11.0.24

Administrators are advised to upgrade to Apache Tomcat 11.0.25, review declarative security constraints and RewriteValve rules, and validate authentication behaviors in DataSourceRealm configurations.

Teams should also remove any unused example applications, restrict local access to Unix Domain Socket environments, and monitor HTTP/2-enabled instances for abnormal stream-reset activity.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC