The Apache Software Foundation has released critical updates for Apache Tomcat, an open-source Java servlet container, addressing several security vulnerabilities. These patches, included in version 11.0.25, are essential for maintaining the integrity and availability of systems utilizing Tomcat.
Key Vulnerabilities Addressed
On August 25, 2026, Apache disclosed multiple flaws, ranging from minor authentication issues to significant bugs that could allow attackers to bypass security measures or execute denial-of-service attacks. Users operating Tomcat versions 11.0.0-M1 through 11.0.24 are strongly encouraged to apply these updates immediately, especially those in enterprise, cloud, or Linux settings.
Among the most critical vulnerabilities is CVE-2026-65182, which involves a bypass of security constraints. This issue arises when a rule for a longer URL path is prioritized over stricter rules for shorter paths, potentially allowing unauthorized access to protected resources.
Authentication and Access Control Issues
A significant concern is CVE-2026-68569, which affects various authentication methods like CLIENT-CERT and SPNEGO. This flaw can lead to fail-open scenarios where non-existent users in the DataSourceRealm may still gain access, compromising identity verification.
Another vulnerability, CVE-2026-65927, involves an off-by-one error in the RewriteValve component, allowing crafted rewrite rules to bypass access controls. Additionally, CVE-2026-68525 demonstrates how FORM authentication redirects can circumvent method-specific constraints, potentially exposing resources intended to be restricted to POST requests.
Denial-of-Service and Resource Exhaustion
Tomcat’s HTTP/2 and WebSocket implementations also contained vulnerabilities that could lead to server crashes. CVE-2026-68763 involves an allocation leak in HTTP/2 backlog tracking, which attackers could exploit by resetting streams to exhaust server resources.
Similarly, CVE-2026-66299 affects the WebSocket chat example, where an unbounded message buffer could enable a slow client to cause continuous memory growth, ultimately crashing the Tomcat process. Notably, systems that have removed example applications following prior advice are not affected by this vulnerability.
Apache recommends upgrading to version 11.0.25 to mitigate these risks. The combination of access control and service disruption flaws presents significant risks of data exposure and service downtime, particularly for internet-facing deployments.
Ensure your Tomcat servers are secure by implementing these updates promptly, safeguarding your systems against potential exploitation of these vulnerabilities.
