Critical Apache Tomcat Flaws Let Attackers Bypass Security, Crash Servers

Key Takeaways

• Apache has released patches for twelve security vulnerabilities in its Tomcat server software.
• The flaws, disclosed on August 25, 2026, affect Apache Tomcat versions 11.0.0-M1 through 11.0.24.
• Impacts range from critical authentication bypasses and information exposure to denial-of-service conditions.
• Immediate upgrade to Apache Tomcat 11.0.25 is strongly recommended to mitigate risks.

Apache Tomcat Patches Critical Security Flaws

The Apache Software Foundation has addressed a dozen security vulnerabilities in Apache Tomcat, the ubiquitous open-source Java servlet container. These fixes have been integrated into version 11.0.25 of the software.

Unveiled on August 25, 2026, the identified flaws span a spectrum of severity, from minor authentication issues to significant bugs that could allow attackers to circumvent access controls or render production servers inoperable through denial-of-service attacks. Organizations leveraging Tomcat 11.0.0-M1 up to 11.0.24 in various environments, including enterprise, cloud, or Linux setups, are urged to prioritize this patching cycle.

Authentication and Authorization Bypass Vulnerabilities

Several of the recently remediated issues directly impact Tomcat’s core authorization mechanisms. Among them, CVE-2026-65182, classified as important, stands out as particularly concerning.

This vulnerability arises from how Tomcat processes security constraints. Specifically, if a security rule designed for a broader URL path was configured before a more stringent rule for a shorter sub-path, the stricter constraint could be inadvertently bypassed. This scenario potentially exposes sensitive resources to unauthorized users, undermining intended access restrictions.

Another related flaw, CVE-2026-68569, also deemed important, impacted authentication methods such as CLIENT-CERT and SPNEGO. Under specific circumstances, individuals not even registered within the DataSourceRealm could still achieve authentication. This “fail-open” scenario severely compromises identity verification protocols.

Additionally, CVE-2026-65927 exposed an off-by-one error within the RewriteValve component. Here, the [N] flag erroneously caused rule processing to recommence at the second rule instead of the first, thereby creating an avenue for attackers to bypass access controls using carefully constructed rewrite rules.

Two further lower-severity bugs contribute to the access-control cluster. CVE-2026-68525 demonstrated that redirects initiated by FORM-based authentication could bypass method-specific constraints. This allowed attackers to access resources intended for POST requests via GET requests instead. Meanwhile, CVE-2026-66422 involved the incorrect application of servlet role-reference definitions as realm-level role aliases, deviating from their intended use solely with Request.isUserInRole().

Denial-of-Service and Other Critical Issues

Beyond authentication vulnerabilities, Apache Tomcat’s HTTP/2 and WebSocket implementations contained bugs that could lead to outright server crashes. CVE-2026-68763, categorized as important, involved an allocation leak in HTTP/2 backlog tracking. This leak was triggered when a stream was reset, a technique attackers could exploit to exhaust server resources and instigate a denial-of-service state.

Similarly, CVE-2026-66299 affected the bundled WebSocket chat example. An unbounded message buffer in this example meant that a deliberately slow client could force continuous memory consumption, ultimately leading to the failure of the Tomcat process. It is worth noting that administrators who have followed previous security recommendations to remove example applications are not affected by this specific vulnerability.

A separate moderate-severity flaw, CVE-2026-65637, revealed that an earlier patch for CVE-2026-32990, which aimed to address strict SNI validation in HTTP/2, was incomplete. This oversight allowed for a “no-authority” bypass.

The remaining disclosures include two low-severity issues: CVE-2026-73180, where authenticated WebSocket sessions could persist beyond their parent HTTP session after a session ID change, conflicting with the Jakarta WebSocket specification. CVE-2026-65183, a time-of-check-to-time-of-use (TOCTOU) race condition, affected permissions on Unix Domain Sockets, potentially granting unauthorized local users access. Lastly, a limited replay-attack vector in DIGEST authentication, CVE-2026-65905, was also addressed.

Apache has published fixing commits for each vulnerability. The recommended remediation is straightforward: immediate upgrade to Apache Tomcat 11.0.25. Considering the combination of access-control bypasses and service-disruption bugs, delaying these patches poses risks to both data integrity and system uptime, especially for internet-facing deployments.

What You Should Do

• Upgrade Immediately: Apply the update to Apache Tomcat 11.0.25 without delay.
• Review Deployment Configurations: Verify that example applications and unnecessary components have been removed from your Tomcat installations, particularly if you are running older versions.
• Monitor Logs: Increase vigilance in monitoring authentication and access logs for any unusual activity.
• Implement Least Privilege: Ensure that all user accounts and system processes operate with the minimum necessary permissions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.