Threat database

A race condition vulnerability in Apache Tomcat Native allows client certificate verification requirements to be downgraded under certain configurations. This affects versions 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15. The issue is fixed in versions 1.3.9 and 2.0.16. The vulnerability has a high severity rating with a CVSS score of 7.4.

A buffer over-read vulnerability (CWE-126) exists in Apache Tomcat Native during the TLS handshake process. This flaw allows a malicious user to cause a denial of service (DoS) by triggering a JVM crash. The issue affects Apache Tomcat Native versions from 2.0.0 through 2.0.15 and from 1.3.0 through 1.3.8. Upgrading to versions 1.3.9 or 2.0.16 resolves the vulnerability.

CVE-2026-86246 is a critical vulnerability in Apache Tomcat Native where insecure default options are enabled during resource initialization. This affects versions 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15. The insecure defaults include ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX. Upgrading to versions 1.3.9 or 2.0.16 addresses the issue.

CVE-2026-87022 is a high-severity vulnerability in Apache Tomcat involving improper handling of length parameter inconsistencies when using per-message-deflate in WebSocket communications. This flaw allows WebSocket message smuggling, potentially enabling attackers to interfere with message integrity. The vulnerability affects multiple versions of Apache Tomcat, including 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, and some older end-of-support versions. Fixed versions are available, and users are advised to upgrade to 11.0.26, 10.1.60, or 9.1.22 to mitigate the issue.

CVE-2026-86350 is a critical vulnerability in Apache Tomcat involving inconsistent interpretation of HTTP/2 requests, leading to HTTP Request/Response smuggling. This flaw is a regression from a previous fix (CVE-2026-41293) and can cause request header mix-ups. It affects Apache Tomcat versions 9.0.118 through 9.0.121, 10.1.55 through 10.1.59, and 11.0.22 through 11.0.25. Upgrading to versions 9.0.122, 10.1.60, or 11.0.26 resolves the issue.

A race condition vulnerability (CWE-362) in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request due to improper synchronization of shared resources. This affects multiple versions of Apache Tomcat including 8.5.59 through 8.5.100, 9.0.39 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25. The issue is fixed in versions 8.5.101 and later, 9.0.122 and later, 10.1.60 and later, and 11.0.26 and later. The vulnerability has a high severity with a CVSS score of 8.1.

CVE-2026-77756 is a medium severity vulnerability in Apache Tomcat involving inconsistent interpretation of HTTP requests, specifically HTTP Request/Response Smuggling. The issue arises from how the transfer-encoding header is processed for HTTP/1.0 requests when Tomcat is behind a reverse proxy, potentially causing one user's request to fail due to another user's request. Affected versions include Apache Tomcat 8.5.67 through 8.5.100, 9.0.47 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25. Users are advised to upgrade to fixed versions 8.5.101 or later, 9.0.122 or later, 10.1.60 or later, or 11.0.26 or later to remediate the issue.

CVE-2026-76183 is a critical authentication bypass vulnerability in Apache Tomcat affecting multiple versions from 7.0.43 through 11.0.25. It allows bypassing security constraints on WebSocket endpoints, potentially enabling unauthorized access. The issue is fixed in Apache Tomcat versions 11.0.26, 10.1.60, and 9.0.122. Users should upgrade to these versions to mitigate the risk.

CVE-2026-75973 is an improper authentication vulnerability in Apache Tomcat affecting multiple versions. When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications use it, the authentication realm from the first web application is incorrectly applied to all others. This can lead to authentication bypass or cross-application authentication issues. The vulnerability affects Apache Tomcat versions from 8.5.0 through 8.5.100, 9.0.0.M4 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25. Fixed versions are 8.5.101, 9.0.122, 10.1.60, and 11.0.26. The CVSS score is 7.3 (high severity).

A vulnerability in Apache Tomcat's CLIENT_CERT authentication allows authentication to not fail as expected in certain scenarios when soft fail is disabled. This affects multiple versions of Apache Tomcat and can lead to critical impacts on confidentiality, integrity, and availability. Fixed versions have been released to address this issue.

CVE-2026-79677 is a high-severity vulnerability in Apache Tomcat involving a missing release of resources after their effective lifetime, specifically related to asynchronous WebSocket writes. This flaw can cause denial of service due to lost timeouts. It affects multiple versions across several major Tomcat branches, including 7.0.43 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25. Fixed versions are 11.0.26, 10.1.60, and 9.0.122.

CVE-2026-78437 is an incomplete cleanup vulnerability in Apache Tomcat that may cause one user's request to fail due to a malformed request from another user, depending on timing. It affects Apache Tomcat versions 9.0.116 through 9.0.121, 10.1.53 through 10.1.59, and 11.0.19 through 11.0.25. The issue is fixed in versions 9.0.122, 10.1.60, and 11.0.26.

CVE-2026-78383 is a high severity vulnerability in Apache Tomcat involving allocation of resources without limits or throttling. It allows an unauthenticated AJP request to pin an AJP processing thread, causing denial of service. Affected versions include Apache Tomcat from 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, and some older EOL versions. Upgrading to versions 11.0.26, 10.1.60, or 9.0.122 mitigates the issue.

CVE-2026-77791 is an Uncontrolled Resource Consumption vulnerability in Apache Tomcat that allows a denial-of-service (DoS) attack during the sending of WebSocket close messages. This affects multiple Apache Tomcat versions, including 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, 9.0.74 through 9.0.121, and some end-of-life versions 8.5.88 through 8.5.100. Users are advised to upgrade to fixed versions 11.0.26, 10.1.60, or 9.0.122 to mitigate the issue. The vulnerability has a CVSS score of 7.5, indicating high severity.

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue.

A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache Sling Security Bundle: before 1.3.12. Users are recommended to upgrade to version 1.3.12, which fixes the issue.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.