Apache has released version 11.0.25 of Apache Tomcat to address ten security vulnerabilities, including multiple flaws that could lead to authentication bypasses, access-control evasion, and denial-of-service (DoS) conditions.
The most serious issues affect Tomcat’s processing of security constraints, authentication mechanisms, HTTP/2 implementation, and behavior of the RewriteValve.
All ten vulnerabilities impact releases of Apache Tomcat 11, with most affecting versions from 11.0.0-M1 through 11.0.24. Organizations running these affected versions should prioritize upgrading to version 11.0.25.
One significant vulnerability, tracked as CVE-2026-65182, relates to how Tomcat processes security constraints. A security restriction could be bypassed when a longer-path constraint appears before a more restrictive constraint that covers a shorter sub-path.
This could expose protected web application resources that rely on declarative URL-based access policies.
Another important issue, CVE-2026-68569, may cause principal lookups to fail open in DataSourceRealm configurations. With certain authentication methods, including CLIENT-CERT and SPNEGO, Tomcat might treat a user as authenticated even if that user does not exist in the configured DataSourceRealm.
Apache also fixed CVE-2026-65927, an off-by-one error in the RewriteValve’s handling of the [N] flag. This error caused rewrite processing to restart at the second rule rather than the first, potentially allowing attackers to bypass access controls implemented through rewrite rules.
CVE-2026-68763 is a significant HTTP/2 vulnerability caused by a backlog-tracking allocation leak when a stream is reset. An attacker could exploit this flaw to consume resources and trigger a denial-of-service condition.
Additionally, Tomcat’s bundled WebSocket chat example is affected by CVE-2026-66299. The example application utilized an unbounded buffer for undelivered messages, allowing a deliberately slow client to force continuous memory growth until the Tomcat process exhausts its memory and fails. Deployments that have followed Apache’s security guidance by removing example web applications are not affected.
The update also addresses a moderate HTTP/2 issue, CVE-2026-65637, which represents an incomplete fix for CVE-2026-32990. This vulnerability could bypass strict Server Name Indication (SNI) validation when an HTTP/2 request lacks an authority value.
CVE Details
| CVE | Severity | Vulnerability | Affected Versions |
|---|---|---|---|
| CVE-2026-73180 | Low | Authenticated WebSocket session remains active after associated HTTP session ends following session-ID change | 11.0.0-M1 to 11.0.24 |
| CVE-2026-68763 | Important | HTTP/2 backlog-tracking allocation leak enables DoS when streams are reset | 11.0.0-M1 to 11.0.24 |
| CVE-2026-68569 | Important | DataSourceRealm principal lookup may fail open for CLIENT-CERT and SPNEGO authentication | 11.0.0-M1 to 11.0.24 |
| CVE-2026-68525 | Low | FORM authentication redirect may bypass POST-specific security constraints | 11.0.0-M1 to 11.0.24 |
| CVE-2026-66422 | Low | security-role-ref definitions may bypass declarative role constraints | 11.0.0-M1 to 11.0.24 |
| CVE-2026-66299 | Low | Unbounded WebSocket chat-example buffer permits memory-exhaustion DoS | 11.0.0-M20 to 11.0.24 |
| CVE-2026-65927 | Important | RewriteValve [N] processing error may bypass access-control rules | 11.0.0-M1 to 11.0.24 |
| CVE-2026-65905 | Low | Limited one-time replay attack against DIGEST authentication requests | 11.0.0-M1 to 11.0.24 |
| CVE-2026-65637 | Moderate | HTTP/2 no-authority requests may bypass strict SNI validation | 11.0.20 to 11.0.24 |
| CVE-2026-65183 | Low | Unix Domain Socket creation race condition enables unauthorized local access | 11.0.0-M1 to 11.0.24 |
| CVE-2026-65182 | Important | Security-constraint ordering flaw enables access-control bypass | 11.0.0-M1 to 11.0.24 |
Administrators are advised to upgrade to Apache Tomcat 11.0.25, review declarative security constraints and RewriteValve rules, and validate authentication behaviors in DataSourceRealm configurations.
Teams should also remove any unused example applications, restrict local access to Unix Domain Socket environments, and monitor HTTP/2-enabled instances for abnormal stream-reset activity.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…