Apache Tomcat 11.0.25 Fixes 11 Vulnerabilities Including HTTP/2 DoS, Authorization Bypass, and Auth Fail-Open Flaws — NVD Scores 5 of 11 CRITICAL/HIGH Despite Apache's Low/Moderate Ratings

Apache Tomcat 11.0.25 Fixes 11 Vulnerabilities Including (TL-2026-2159) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-08-26. It has no confirmed attribution, affects Apache Software Foundation Apache Tomcat, references 11 CVEs (CVE-2026-65182, CVE-2026-68569, CVE-2026-68763), maps to 9 MITRE ATT&CK techniques (T1046, T1078, T1190), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-2159

Threat ID
TL-2026-2159
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-08-26
Last reviewed
2026-08-26
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, government administration, financial-services, health, education, retail, telecoms
Target regions
Global
Detection rules
9
Indicators of compromise
21

Apache Tomcat 11.0.25 (released 2026-08-18, disclosed 2026-08-25) patches eleven CVEs affecting 11.0.0-M1 through 11.0.24: an HTTP/2 allocation-leak DoS, a WebSocket example memory-exhaustion DoS, four distinct authorization/authentication bypasses, a CLIENT-CERT/SPNEGO authentication fail-open, a DIGEST auth replay flaw, an incomplete SNI-validation fix for HTTP/2, a Unix Domain Socket TOCTOU local-privilege issue, and a WebSocket session lifecycle bug. NVD assigned CVSS 3.1 base scores of 9.8 CRITICAL to two of these (CVE-2026-65637, CVE-2026-65905) and 9.1/8.1 to three more, sharply diverging from Apache's own 'Moderate'/'Low' contextual ratings for the same flaws. No active exploitation or public PoC is reported for any of the eleven.

How Apache Tomcat 11.0.25 Fixes 11 Vulnerabilities Including works

On 2026-08-25 the Apache Software Foundation disclosed eleven CVEs against Apache Tomcat, all fixed in the 11.0.25 release (built 2026-08-18). Four of the eleven also affect the 10.1.x and 9.0.x branches; those are fixed in Tomcat 9.0.121, while the 10.1.x fix required two release attempts — Apache's originally announced 10.1.58 failed its release vote, so the actual fixed release for CVE-2026-65182, CVE-2026-68569, CVE-2026-68763, and CVE-2026-65927 on the 10.1.x branch is 10.1.59 (per tomcat.apache.org/security-10.html), a detail the 11.0.x advisory and most secondary reporting do not surface. The bundle spans denial-of-service, authentication, and authorization defects rather than remote code execution.

Apache's advisory rates only four of the eleven 'Important' (its highest rating in this batch): CVE-2026-65182 (security-constraint bypass), CVE-2026-68569 (CLIENT-CERT/SPNEGO principal fail-open), CVE-2026-68763 (HTTP/2 allocation-leak DoS), and CVE-2026-65927 (RewriteValve off-by-one). NVD's independent, context-free CVSS 3.1 scoring diverges sharply from Apache's ratings across the whole bundle, not just for the 'Important' four: CVE-2026-65637 (Apache: 'Moderate' — an incomplete fix for the earlier CVE-2026-32990 letting an HTTP/2 request with no ':authority' pseudo-header bypass strict SNI validation, CWE-20) and CVE-2026-65905 (Apache: 'Low' — a DIGEST-authentication replay flaw where a request made with a nonceCount at the upper boundary of the replay window can be replayed exactly once, CWE-294) both score 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CVE-2026-65182 (CWE-284/CWE-863) and CVE-2026-68525 (Apache: 'Low' — a FORM-authentication redirect that bypasses a security constraint scoped to POST but not GET, CWE-863) both score 9.1 CRITICAL. CVE-2026-68569 (CWE-287), CVE-2026-66422 (Apache: 'Low' — security-role-ref definitions meant only for Request.isUserInRole() misused as realm-level role aliases, CWE-285), and CVE-2026-65183 (Apache: 'Low' — a TOCTOU race condition when Tomcat sets Unix Domain Socket filesystem permissions, letting an unauthorized local user connect before permissions tighten, CWE-367) each score 8.1 HIGH. CVE-2026-68763 and CVE-2026-65927 both score 7.5 HIGH, as does CVE-2026-66299 (the WebSocket chat example's unbounded undelivered-message buffer, which a deliberately slow client can grow until the Tomcat process fails on memory exhaustion; CWE-400 — instances that removed the bundled `examples` webapp are unaffected). CVE-2026-73180, the lowest-scored issue (6.8 MEDIUM, CWE-613 Insufficient Session Expiration), is a WebSocket session that outlives its parent HTTP session per the Jakarta WebSocket specification if the HTTP session ID changes after the WebSocket connects.

This divergence matters operationally: Apache's ratings already bake in real-world caveats NVD's automated scoring does not — CVE-2026-65905 requires a narrow timing window on a specific nonceCount value to yield exactly one replay, and CVE-2026-65183's real AV is Local (its 8.1 NVD score assumes AV:N but the actual attack requires local filesystem/socket race access, which Apache reflects by rating it 'Low'), while CVE-2026-65637 and CVE-2026-68525 require specific deployment choices (HTTP/2 enabled without additional virtual-host controls; POST-only constraints relied on for security) to be exploitable as scored. Defenders triaging by NVD score alone would over-prioritize several 'Low'-rated items and should read Apache's own advisory text, not just the NVD number, before re-ranking patch order.

An eighth-issue-adjacent finding from third-party analysis (HeroDevs) notes that 8 of the 11 CVEs also affect the end-of-life Tomcat 8.5.x branch (EOL since 2024-03-31, version 8.5.100), which has no vendor fix available and already carries an accumulated 48 unpatched CVEs over 877 days, including CVE-2025-24813 — a 9.8-CRITICAL RCE actively exploited and listed in the CISA Known Exploited Vulnerabilities catalog. Organizations still running 8.5.x should treat this disclosure as additional pressure to migrate off the EOL branch rather than as eleven more individually patchable items.

No source (Apache's advisory, NVD, the CISA KEV catalog as of 2026-08-26, or the openwall oss-security mailing list co-disclosure) reports active exploitation or public proof-of-concept code for any of the eleven 11.0.25 CVEs. Given Tomcat's ubiquity as an internet-facing Java application server, the combination of an unauthenticated DoS vector (CVE-2026-68763), two CVSS-9.8 issues (CVE-2026-65637, CVE-2026-65905), and several authorization-bypass primitives (CVE-2026-65182, CVE-2026-65927, CVE-2026-68525, CVE-2026-66422) makes prompt patching to 11.0.25 / 10.1.59 / 9.0.121 the primary mitigation, with `webapps/examples` removal and `web.xml` constraint-ordering review as interim compensating controls.

MITRE ATT&CK techniques used in TL-2026-2159

Discovery

T1046 Network Service Discovery

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access

Impact

T1499.003 Endpoint Denial of Service: Application Exhaustion Flood; T1499.004 Endpoint Denial of Service: Application or System Exploitation

defense-impairment

T1556 Modify Authentication Process

Reconnaissance

T1592.002 Gather Victim Host Information: Software; T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in Apache Tomcat 11.0.25 Fixes 11 Vulnerabilities Including

  • Apache Software Foundation — Apache Tomcat
    Vulnerable versions: 11.0.0-M1 through 11.0.24
    Fixed in: 11.0.25
  • Apache Software Foundation — Apache Tomcat
    Vulnerable versions: 11.0.0-M20 through 11.0.24 (CVE-2026-66299 only, webapps/examples)
    Fixed in: 11.0.25
  • Apache Software Foundation — Apache Tomcat
    Vulnerable versions: 11.0.20 through 11.0.24 (CVE-2026-65637 only)
    Fixed in: 11.0.25
  • Apache Software Foundation — Apache Tomcat
    Vulnerable versions: 10.1.0-M1 through 10.1.57 (CVE-2026-65182, CVE-2026-68569, CVE-2026-68763, CVE-2026-65927)
    Fixed in: 10.1.59 (10.1.58 was announced but its release vote failed and it was never published)
  • Apache Software Foundation — Apache Tomcat
    Vulnerable versions: 9.0.39 through 9.0.120 (CVE-2026-65182, CVE-2026-68569, CVE-2026-68763, CVE-2026-65927); 9.0.25 through 9.0.120 (CVE-2026-66422); 9.0.89 through 9.0.120 (CVE-2026-66299)
    Fixed in: 9.0.121
  • Apache Software Foundation — Apache Tomcat
    Vulnerable versions: 8.5.0 through 8.5.100 (EOL since 2024-03-31); confirmed vulnerable to at least 8 of the 11 CVEs per NVD and HeroDevs analysis
    Fixed in: none — 8.5.x is end-of-life, upgrade to a supported branch

Remediation for Apache Tomcat 11.0.25 Fixes 11 Vulnerabilities Including

Patches

  • Apache Tomcat 11.0.25 (11.0.x branch, all 11 CVEs)
  • Apache Tomcat 10.1.59 (10.1.x branch, CVE-2026-65182/68569/68763/65927 — 10.1.58 was never released after a failed release vote)
  • Apache Tomcat 9.0.121 (9.0.x branch, CVE-2026-65182/68569/68763/65927)

Immediate actions

  • Upgrade to Apache Tomcat 11.0.25 on the 11.0.x branch
  • Upgrade to Apache Tomcat 10.1.59 (NOT 10.1.58 — that release's vote failed) if running the 10.1.x branch, which shares CVE-2026-65182, CVE-2026-68569, CVE-2026-68763, and CVE-2026-65927
  • Upgrade to Apache Tomcat 9.0.121 if running the 9.0.x branch, sharing the same four CVEs
  • If immediate patching is not possible, remove the bundled webapps/examples application to eliminate the CVE-2026-66299 WebSocket chat DoS
  • Audit conf/web.xml security-constraint declarations for longer-path-before-shorter-path ordering that triggers the CVE-2026-65182 bypass (CVSS 9.1)
  • Re-triage this bundle by reading Apache's advisory text alongside the NVD score — five of the eleven CVEs Apache calls 'Low'/'Moderate' score 8.1-9.8 CRITICAL/HIGH under NVD's context-free CVSS

Workarounds

  • Remove webapps/examples to mitigate CVE-2026-66299 without upgrading
  • Reorder web.xml security-constraint entries so shorter, more-restrictive paths precede longer paths to reduce CVE-2026-65182 exposure pending patch
  • Disable HTTP/2 or add virtual-host-level authority validation to reduce CVE-2026-65637 exposure pending patch

Longer-term hardening

  • Track the Apache Tomcat security advisory feed (tomcat.apache.org/security-11.html, security-10.html, security-9.html) for future fixes
  • Add explicit principal-existence validation for CLIENT-CERT/SPNEGO realms backed by DataSourceRealm to defend in depth against CVE-2026-68569-class fail-open logic
  • Review RewriteValve rule sets using the [N] flag for reliance on strict rule-restart-at-first-rule behavior (CVE-2026-65927)
  • Restrict or avoid multi-tenant use of Unix Domain Socket connectors given the CVE-2026-65183 TOCTOU permission window
  • Plan migration off Apache Tomcat 8.5.x — it is EOL with no fix for 8 of these 11 CVEs and already carries 48 unpatched CVEs including the actively-exploited CVE-2025-24813

CVEs associated with Apache Tomcat 11.0.25 Fixes 11 Vulnerabilities Including

CVE-2026-65182, CVE-2026-68569, CVE-2026-68763, CVE-2026-65927, CVE-2026-65637, CVE-2026-68525, CVE-2026-66422, CVE-2026-66299, CVE-2026-65905, CVE-2026-65183, CVE-2026-73180

Weaknesses (CWE) in Apache Tomcat 11.0.25 Fixes 11 Vulnerabilities Including

CWE-284, CWE-863, CWE-287, CWE-400, CWE-193, CWE-20, CWE-285, CWE-294, CWE-367, CWE-613

Timeline of Apache Tomcat 11.0.25 Fixes 11 Vulnerabilities Including

  • CVE-2026-65183 (Unix Domain Socket TOCTOU permission race condition) reported to the Apache Tomcat security team
  • CVE-2026-66299 (WebSocket chat example unbounded buffer DoS) reported to the Apache Tomcat security team
  • CVE-2026-65927 (RewriteValve [N] flag off-by-one), CVE-2026-65905 (DIGEST replay window), CVE-2026-65637 (HTTP/2 SNI validation bypass), and CVE-2026-66422 (servlet role-reference bypass) reported to the Apache Tomcat security team
  • CVE-2026-68525 (FORM authentication redirect bypasses method-specific constraint) reported to the Apache Tomcat security team
  • CVE-2026-68763 (HTTP/2 backlog allocation leak DoS) and CVE-2026-68569 (CLIENT-CERT/SPNEGO principal fail-open) reported to the Apache Tomcat security team
  • CVE-2026-66299 publicly disclosed ahead of the bundled advisory
  • CVE-2026-73180 (WebSocket session outlives HTTP session after session ID change) reported to the Apache Tomcat security team
  • Apache Tomcat 11.0.25 built, fixing all eleven CVEs
  • Apache publishes the consolidated security-11.html and security-10.html advisories disclosing all eleven CVEs, mirrored the same day to the openwall oss-security mailing list; Cyber Security News reports on the release recommending immediate upgrade
  • The originally announced Apache Tomcat 10.1.58 release vote fails and 10.1.58 is never published; the four cross-branch CVEs (65182, 68569, 68763, 65927) are instead fixed in 10.1.59, while 9.0.121 ships as planned for the 9.0.x branch
  • Third-party analysis (HeroDevs) notes 8 of the 11 CVEs also affect the end-of-life Tomcat 8.5.x branch, which has no available fix and already carries 48 unpatched CVEs over 877 days, including the actively-exploited CVE-2025-24813
  • NVD publishes independent CVSS 3.1 base scores for all eleven CVEs; five score CRITICAL/HIGH (9.8, 9.8, 9.1, 9.1, 8.1, 8.1, 8.1) despite Apache rating the same issues 'Low' or 'Moderate' in its own advisory

Sources cited for Apache Tomcat 11.0.25 Fixes 11 Vulnerabilities Including

More in vulnerability

Detection coverage for TL-2026-2159

As of 2026-08-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2159 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats