Apache Software Foundation has released Tomcat 11.0.26 to address 12 security vulnerabilities spanning WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation.
The flaws, disclosed September 23, 2026, include four rated Important, three Moderate, and five Low, giving administrators a broad but urgent patching task across internet-facing Java application servers.
Most existing Tomcat 11 deployments are exposed: many issues affect versions 11.0.0-M1 through 11.0.25, while narrower flaws begin at 11.0.0-M5, 11.0.0-M14, 11.0.19, or 11.0.22. Apache does not provide binary patches for individual vulnerabilities and advises users to install a release containing the fixes, making 11.0.26 the practical remediation baseline.
The headline WebSocket flaw, CVE-2026-87022, stems from improper handling of a length parameter when per-message-deflate compression is enabled. An attacker could exploit the discrepancy to smuggle WebSocket messages; all releases from 11.0.0-M1 through 11.0.25 are affected, and commit 4fef25fe supplies the correction.
A higher-priority HTTP/2 issue, CVE-2026-86350, is a regression introduced while fixing CVE-2026-41293. Inconsistent request interpretation can cause headers to be associated incorrectly, creating a request-header mix-up in versions 11.0.22 through 11.0.25.
Related HTTP/2 defects include CVE-2026-78437, where a malformed request can make another user’s request fail, and CVE-2026-77762, a race condition that can inject trailer fields into a recycled pooled request.
Availability risks feature prominently. CVE-2026-78383 can pin an AJP processing thread when a request body is absent, while CVE-2026-77791 permits denial of service through a busy wait while sending a WebSocket close message. CVE-2026-79677 can lose asynchronous WebSocket write timeouts because of a concurrency bug, leaving operations able to consume resources indefinitely.
The update also closes CVE-2026-76183, an Important WebSocket authorization bypass caused by parsing request paths as endpoint templates. CVE-2026-75973 could reuse the first application’s realm across multiple applications using Jakarta Authentication’s default SimpleAuthConfigProvider, while CVE-2026-77756 could disrupt another user’s request by honoring Transfer-Encoding in HTTP/1.0 traffic behind a reverse proxy.
Certificate checking receives two notable repairs. CVE-2026-86248 addresses an incomplete earlier OCSP fix that could let CLIENT_CERT authentication succeed when soft-fail was disabled under the FFM implementation. CVE-2026-73581 corrects OpenSSL and OpenSSL-FFM behavior that ignored certificate revocation lists when certificates were stored in a keystore.
Administrators should inventory every Tomcat 11 instance, prioritize externally reachable WebSocket, HTTP/2, and AJP connectors, and upgrade to 11.0.26 after testing application compatibility.
They should also verify downloaded artifacts using Apache’s OpenPGP signatures or SHA-512 checksums, review reverse-proxy and authentication configurations, and monitor for unusual connection exhaustion, cross-request header anomalies, or authorization failures.
Because several bugs involve races and shared connection state, successful exploitation may be intermittent, making controlled regression testing and sustained telemetry especially important after the emergency rollout across clusters. Restart and confirm the running version after deployment; configuration-only workarounds do not provide equivalent coverage for this multi-component security release.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
