The Apache Software Foundation has issued a critical update to Tomcat, version 11.0.26, aimed at addressing a series of security vulnerabilities. These issues concern vital components such as WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation. This update is imperative for administrators managing internet-facing Java application servers.
Security Vulnerabilities and Affected Versions
On September 23, 2026, Apache disclosed 12 security flaws in Tomcat, categorized into four Important, three Moderate, and five Low severity levels. These vulnerabilities pose a significant challenge for administrators tasked with patching systems across their deployments. Versions impacted range from 11.0.0-M1 to 11.0.25, with more specific issues starting from 11.0.0-M5, 11.0.0-M14, 11.0.19, and 11.0.22.
Among the most notable is a WebSocket vulnerability, CVE-2026-87022, which originates from incorrect length parameter handling when per-message-deflate compression is enabled. This flaw, affecting all versions from 11.0.0-M1 to 11.0.25, could be exploited to manipulate WebSocket messages. The patch for this issue is included in commit 4fef25fe.
Key HTTP/2 and WebSocket Issues
Another critical issue, CVE-2026-86350, involves a regression in HTTP/2 handling, introduced during a previous fix. This inconsistency could lead to improper header associations, affecting versions 11.0.22 through 11.0.25. Additional HTTP/2 concerns include CVE-2026-78437, where malformed requests disrupt other users, and CVE-2026-77762, a race condition that could inject trailer fields improperly.
WebSocket issues also present significant risks. CVE-2026-77791 allows for denial of service via busy waits during WebSocket close message transmissions, while CVE-2026-79677 involves asynchronous write timeout problems due to concurrency errors.
Upgrade Recommendations and Verification
To safeguard systems, administrators should carefully inventory their Tomcat 11 deployments, focusing on externally accessible WebSocket, HTTP/2, and AJP connectors. It is crucial to upgrade to version 11.0.26 after confirming application compatibility. Verification of downloaded updates using Apache’s OpenPGP signatures or SHA-512 checksums is recommended, along with a thorough review of reverse-proxy and authentication configurations.
Since several vulnerabilities involve race conditions and shared connection states, exploitation might be sporadic, necessitating rigorous regression testing and continuous monitoring for unusual activities post-update. Administrators should confirm the running version post-deployment, as configuration-only solutions do not fully address the security concerns outlined in this release.
Overall, the Apache Tomcat 11.0.26 update marks a critical step in securing server environments, and administrators are advised to act promptly to ensure their systems are protected against these vulnerabilities.
