Apache Tomcat Patches Critical WebSocket, HTTP/2 Vulnerabilities

Key Takeaways

• The Apache Software Foundation has released Tomcat version 11.0.26, addressing 12 security vulnerabilities.
• These flaws affect various components, including WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation.
• Several issues, including critical WebSocket and HTTP/2 vulnerabilities, could lead to data manipulation, denial of service, or authorization bypass.
• Administrators are urged to upgrade all vulnerable Apache Tomcat 11 instances to version 11.0.26 immediately.

The Apache Software Foundation has issued a critical update, Tomcat 11.0.26, to resolve a dozen security vulnerabilities. These flaws impact various functionalities within the popular Java application server, including its WebSocket, HTTP/2, AJP connectors, authentication mechanisms, and TLS certificate validation processes.

Detailed Vulnerability Breakdown

Disclosed on September 23, 2026, the vulnerabilities comprise four issues rated as Important, three as Moderate, and five as Low in severity. This wide-ranging update presents an urgent patching requirement for administrators managing internet-facing Java application servers.

Affected Versions and Remediation

The majority of existing Tomcat 11 deployments are at risk, as many of these issues impact versions 11.0.0-M1 through 11.0.25. More specific vulnerabilities begin at versions 11.0.0-M5, 11.0.0-M14, 11.0.19, or 11.0.22. The Apache Software Foundation does not offer individual binary patches for specific vulnerabilities; therefore, users are advised to install a release that incorporates all the fixes, making version 11.0.26 the definitive remediation.

Critical WebSocket and HTTP/2 Flaws

A prominent WebSocket vulnerability, identified as CVE-2026-87022, stems from improper handling of a length parameter when per-message-deflate compression is active. This flaw could allow an attacker to smuggle WebSocket messages. All versions from 11.0.0-M1 up to 11.0.25 are affected, with the fix implemented in commit 4fef25fe.

Another significant issue, CVE-2026-86350, is an HTTP/2 regression introduced during the remediation of CVE-2026-41293. This inconsistency in request interpretation can lead to headers being incorrectly associated, resulting in a request-header mix-up for versions 11.0.22 through 11.0.25.

Additional HTTP/2 defects include CVE-2026-78437, which can cause another user’s request to fail due to a malformed request, and CVE-2026-77762, a race condition that allows the injection of trailer fields into a recycled pooled request.

Denial-of-Service Risks

Several vulnerabilities pose significant availability risks. CVE-2026-78383 can cause an AJP processing thread to become unresponsive if a request body is absent. CVE-2026-77791 enables denial of service through a busy wait state when sending a WebSocket close message. Furthermore, CVE-2026-79677, a concurrency bug, can lead to the loss of asynchronous WebSocket write timeouts, allowing operations to consume resources indefinitely.

The update also closes CVE-2026-76183, an Important WebSocket authorization bypass caused by the parsing of request paths as endpoint templates. CVE-2026-75973 could result in the reuse of the first application’s realm across multiple applications that employ Jakarta Authentication’s default SimpleAuthConfigProvider. Additionally, CVE-2026-77756 could disrupt another user’s request by honoring Transfer-Encoding in HTTP/1.0 traffic when behind a reverse proxy.

Certificate Validation Improvements

Two notable repairs address certificate checking. CVE-2026-86248 corrects an incomplete prior OCSP fix that could allow CLIENT_CERT authentication to succeed even when soft-fail was disabled under the FFM implementation. CVE-2026-73581 rectifies behavior in OpenSSL and OpenSSL-FFM where certificate revocation lists were ignored when certificates were stored in a keystore.

What You Should Do

• Upgrade Immediately: Inventory all Apache Tomcat 11 instances and prioritize upgrading to version 11.0.26, particularly those with externally accessible WebSocket, HTTP/2, and AJP connectors.
• Test Compatibility: Before deploying, thoroughly test application compatibility with the new Tomcat version to avoid operational disruptions.
• Verify Downloads: Always verify downloaded artifacts using Apache’s OpenPGP signatures or SHA-512 checksums to ensure integrity and authenticity.
• Review Configurations: Examine reverse-proxy and authentication configurations for any potential misconfigurations that could expose vulnerabilities.
• Monitor Systems: Implement continuous monitoring for unusual connection exhaustion, anomalies in cross-request headers, or any authorization failures that could indicate exploitation attempts.
• Confirm Deployment: After deployment, restart the server and confirm the running version to ensure the update has been successfully applied. Configuration-only workarounds are insufficient for this comprehensive security release.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.