Apache Tomcat security wave fixes authorisation, HTTP/2 and WebSocket flaws

Apache has disclosed a broad Tomcat security update delivered in 11.0.25, 10.1.58 and 9.0.121. The issues do not form one universal remote-code-execution path. They do, however, affect places where Java applications delegate access decisions: security-constraint matching, Realms, FORM and DIGEST authentication, RewriteValve rules, strict SNI validation, WebSocket sessions and HTTP/2 resource handling.

The records entered the overnight 26 August indexing cycle in Central Europe, while the project page records public disclosure on 25 August. The operational threshold matters more than the date boundary: supported branches should move to at least the versions above. Legacy 8.5 and 7.0 releases are also affected in many cases, but are unsupported and did not receive equivalent current releases.

Why a mixed-severity update deserves attention

Apache rates some issues Important and others Moderate or Low. Administrators should neither add scores together nor assume that every server exposes every scenario. Several paths depend on specific configuration: DataSourceRealm, CLIENT-CERT or SPNEGO, RewriteValve with the [N] flag, DIGEST authentication, Unix Domain Sockets, or applications maintaining authenticated WebSockets.

Tomcat is nevertheless the policy-enforcement layer for many applications. A low-rated role-mapping error can have serious business impact if the protected endpoint changes payments, customer data or configuration. Risk assessment therefore needs to combine vendor severity with reachability in the effective server.xml, context.xml, web.xml, application code and proxy topology.

CVE-2026-65182: declaration order changed the constraint result

Apache rates CVE-2026-65182 Important. Vulnerable processing allowed a stricter constraint for a shorter sub-path to be bypassed when a constraint for a longer path was declared first. That breaks an administrator’s core expectation: effective policy should follow matching semantics rather than accidental declaration order.

Affected ranges are Tomcat 11.0.0-M1–11.0.24, 10.1.0-M1–10.1.57 and 9.0.0.M1–9.0.120. The record also lists end-of-life 8.5.0–8.5.100 and 7.0.0–7.0.109. The fix is included in 11.0.25, 10.1.58 and 9.0.121.

Review overlapping URL patterns, roles, http-method and http-method-omission. A single request to one path is insufficient. A regression matrix should cover the base path, a longer prefix, trailing-slash variants, every method and negative roles. Tests must traverse the same connector and proxy as production traffic.

CVE-2026-68569: authentication could fail open

The second Important issue affects cases such as CLIENT-CERT and SPNEGO used with DataSourceRealm. CVE-2026-68569 could treat a principal as authenticated even if no corresponding user existed in the Realm. The distinction matters: an external mechanism may validate a certificate or ticket while the application still expects a local directory to map that principal to an active account and roles.

Supported affected ranges are 11.0.0-M1–11.0.24, 10.1.0-M1–10.1.57 and 9.0.0.M1–9.0.120. Apache also identifies unsupported 8.5 and 7.0 lines. Organisations using client certificates or Kerberos should test not only a valid user but also valid protocol credentials whose name is missing, disabled or normalised differently in the data source.

Logs should correlate success at the protocol layer with the Realm query outcome. “Certificate valid” is not equivalent to “account exists and may enter”. Telemetry should record the principal, identity source, lookup outcome and assigned roles without logging secrets or full tickets.

CVE-2026-65927 and CVE-2026-65637: routing and host boundaries

CVE-2026-65927, also Important, is an off-by-one error in RewriteValve. The [N] flag was supposed to restart rule processing, but execution resumed at the second rule. If the first rule supplied a security function—normalising a path, blocking a pattern or routing through a check—the next pass could skip it.

This does not mean every RewriteValve deployment was unauthorised. Exploitation needs a rule set where repeated processing and omission of the first rule changes a security decision. Inventory [N], set a loop limit and test inputs requiring at least two passes. Until patching, simplify rules so that security does not depend exclusively on the first step.

CVE-2026-65637 is Moderate and represents an incomplete fix for CVE-2026-32990. An HTTP/2 request without :authority could bypass strict SNI validation. It has a narrower range: 11.0.20–11.0.24, 10.1.53–10.1.57 and 9.0.115–9.0.120. The case shows why a consistency check between TLS SNI and the HTTP host needs a secure outcome when a value is absent, not only when two strings differ.

CVE-2026-68763: stream resets and an allocation leak

Under CVE-2026-68763, manipulated HTTP/2 stream resets could trigger an allocation leak in backlog tracking and cause denial of service. Apache rates the issue Important. Affected releases are 11.0.0-M1–11.0.24, 10.1.0-M1–10.1.57 and 9.0.39–9.0.120, plus unsupported 8.5 from 8.5.59.

A proxy may reduce exposure if it terminates HTTP/2 and sends HTTP/1.1 to Tomcat, but this must be confirmed against the real path. In pass-through, h2c or direct-connector deployments, the vulnerable code still processes streams. Monitor process memory, reset counts, active streams, backlog state and restart frequency. A connection limit alone may not prevent many resets inside one connection.

Lower-rated issues can still cross a boundary

The update also includes CVE-2026-68525, where a redirect following FORM authentication could bypass a constraint that denied POST but allowed GET. CVE-2026-66422 involved incorrect use of security-role-ref as aliases inside the Realm beyond their proper meaning for Request.isUserInRole(). CVE-2026-65905 permitted one replay of a particular DIGEST request while its nonceCount remained in the replay window.

CVE-2026-65183 is a local TOCTOU race while creating a Unix Domain Socket, potentially allowing an unauthorised local user to access it. CVE-2026-73180 left an authenticated WebSocket connection alive after the related HTTP session ended when the session identifier changed after connection establishment.

These issues have lower ratings but test critical invariants: the HTTP method remains part of policy; a role alias does not expand a Realm; replay protection is monotonic; socket permissions apply from creation; and a long-lived connection ends when its authentication session is lost. Organisations should not split one release into “important CVEs” and “the rest” when a single upgrade fixes the complete set.

How to deploy the update safely

First establish the effective version of every process. An application image may bundle Tomcat, a framework may include embedded Tomcat, and a PaaS may inject its own runtime. Inspect the SBOM, lockfile, image layers and startup log. For Spring Boot, the resolved tomcat-embed-* version matters, not only the starter version.

Upgrade to 11.0.25, 10.1.58 or 9.0.121, or a later supported patch in the same branch. Migrate Tomcat 8.5 and 7.0 to a supported line instead of waiting for a patch the project does not promise. Do not copy isolated JAR files between installations; keep libraries and launch files consistent with the distribution.

In staging, run positive and negative authorisation tests, CLIENT-CERT or SPNEGO handshakes, rewrite rules, FORM and DIGEST flows, WebSocket session loss, and HTTP/2 load tests. Check configuration and JVM-flag differences. After a canary, compare 401/403 rates, Realm errors, reset streams, memory use and unexpected WebSocket closures.

Configuration-driven prioritisation

Prioritise internet-facing servers with declarative constraints, RewriteValve or direct HTTP/2, along with systems using CLIENT-CERT or SPNEGO through DataSourceRealm. Then review applications with long-lived authenticated WebSockets and shared hosts where a local user could contend for Unix socket resources.

Absence of one feature is not a reason to remain on an old release. The bundle contains several independent bugs, and configuration inventories are often incomplete. If compatibility blocks the patch, restrict public access, terminate HTTP/2 before Tomcat, remove security dependencies from RewriteValve and add application-layer authorisation—but treat those as temporary controls.

Source facts and Breachroad conclusions

CVE names, mechanisms, severity levels, public-disclosure dates, affected ranges and target releases come from Apache Tomcat’s security pages and CVE records. The sources do not report confirmed active exploitation of this group. The test matrix, configuration priorities, monitoring and canary recommendations are Breachroad conclusions.

Secure coding and infrastructure security training helps teams understand authorisation, session and protocol boundaries, while application and API penetration testing can validate effective Tomcat policy in the real deployment.