# Apache Tomcat 11.0.25 Fixes 11 Vulnerabilities Including HTTP/2 DoS, Authorization Bypass, and Auth Fail-Open Flaws — NVD Scores 5 of 11 CRITICAL/HIGH Despite Apache's Low/Moderate Ratings

> Apache Tomcat 11.0.25 (released 2026-08-18, disclosed 2026-08-25) patches eleven CVEs affecting 11.0.0-M1 through 11.0.24: an HTTP/2 allocation-leak DoS, a WebSocket example memory-exhaustion DoS, four distinct authorization/authentication bypasses, a CLIENT-CERT/SPNEGO authentication fail-open, a DIGEST auth replay flaw, an incomplete SNI-validation fix for HTTP/2, a Unix Domain Socket TOCTOU local-privilege issue, and a WebSocket session lifecycle bug. NVD assigned CVSS 3.1 base scores of 9.8 CRITICAL to two of these (CVE-2026-65637, CVE-2026-65905) and 9.1/8.1 to three more, sharply diverging from Apache's own 'Moderate'/'Low' contextual ratings for the same flaws. No active exploitation or public PoC is reported for any of the eleven.

- **Published:** 2026-08-26T00:00:00Z
- **Last reviewed:** 2026-08-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2159
- **ID:** TL-2026-2159
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-65182, CVE-2026-68569, CVE-2026-68763, CVE-2026-65927, CVE-2026-65637, CVE-2026-68525, CVE-2026-66422, CVE-2026-66299, CVE-2026-65905, CVE-2026-65183, CVE-2026-73180, CVE-2026-32990

## Description

On 2026-08-25 the Apache Software Foundation disclosed eleven CVEs against Apache Tomcat, all fixed in the 11.0.25 release (built 2026-08-18). Four of the eleven also affect the 10.1.x and 9.0.x branches; those are fixed in Tomcat 9.0.121, while the 10.1.x fix required two release attempts — Apache's originally announced 10.1.58 failed its release vote, so the actual fixed release for CVE-2026-65182, CVE-2026-68569, CVE-2026-68763, and CVE-2026-65927 on the 10.1.x branch is 10.1.59 (per tomcat.apache.org/security-10.html), a detail the 11.0.x advisory and most secondary reporting do not surface. The bundle spans denial-of-service, authentication, and authorization defects rather than remote code execution.

Apache's advisory rates only four of the eleven 'Important' (its highest rating in this batch): CVE-2026-65182 (security-constraint bypass), CVE-2026-68569 (CLIENT-CERT/SPNEGO principal fail-open), CVE-2026-68763 (HTTP/2 allocation-leak DoS), and CVE-2026-65927 (RewriteValve off-by-one). NVD's independent, context-free CVSS 3.1 scoring diverges sharply from Apache's ratings across the whole bundle, not just for the 'Important' four: CVE-2026-65637 (Apache: 'Moderate' — an incomplete fix for the earlier CVE-2026-32990 letting an HTTP/2 request with no ':authority' pseudo-header bypass strict SNI validation, CWE-20) and CVE-2026-65905 (Apache: 'Low' — a DIGEST-authentication replay flaw where a request made with a nonceCount at the upper boundary of the replay window can be replayed exactly once, CWE-294) both score 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CVE-2026-65182 (CWE-284/CWE-863) and CVE-2026-68525 (Apache: 'Low' — a FORM-authentication redirect that bypasses a security constraint scoped to POST but not GET, CWE-863) both score 9.1 CRITICAL. CVE-2026-68569 (CWE-287), CVE-2026-66422 (Apache: 'Low' — security-role-ref definitions meant only for Request.isUserInRole() misused as realm-level role aliases, CWE-285), and CVE-2026-65183 (Apache: 'Low' — a TOCTOU race condition when Tomcat sets Unix Domain Socket filesystem permissions, letting an unauthorized local user connect before permissions tighten, CWE-367) each score 8.1 HIGH. CVE-2026-68763 and CVE-2026-65927 both score 7.5 HIGH, as does CVE-2026-66299 (the WebSocket chat example's unbounded undelivered-message buffer, which a deliberately slow client can grow until the Tomcat process fails on memory exhaustion; CWE-400 — instances that removed the bundled `examples` webapp are unaffected). CVE-2026-73180, the lowest-scored issue (6.8 MEDIUM, CWE-613 Insufficient Session Expiration), is a WebSocket session that outlives its parent HTTP session per the Jakarta WebSocket specification if the HTTP session ID changes after the WebSocket connects.

This divergence matters operationally: Apache's ratings already bake in real-world caveats NVD's automated scoring does not — CVE-2026-65905 requires a narrow timing window on a specific nonceCount value to yield exactly one replay, and CVE-2026-65183's real AV is Local (its 8.1 NVD score assumes AV:N but the actual attack requires local filesystem/socket race access, which Apache reflects by rating it 'Low'), while CVE-2026-65637 and CVE-2026-68525 require specific deployment choices (HTTP/2 enabled without additional virtual-host controls; POST-only constraints relied on for security) to be exploitable as scored. Defenders triaging by NVD score alone would over-prioritize several 'Low'-rated items and should read Apache's own advisory text, not just the NVD number, before re-ranking patch order.

An eighth-issue-adjacent finding from third-party analysis (HeroDevs) notes that 8 of the 11 CVEs also affect the end-of-life Tomcat 8.5.x branch (EOL since 2024-03-31, version 8.5.100), which has no vendor fix available and already carries an accumulated 48 unpatched CVEs over 877 days, including CVE-2025-24813 — a 9.8-CRITICAL RCE actively exploited and listed in the CISA Known Exploited Vulnerabilities catalog. Organizations still running 8.5.x should treat this disclosure as additional pressure to migrate off the EOL branch rather than as eleven more individually patchable items.

No source (Apache's advisory, NVD, the CISA KEV catalog as of 2026-08-26, or the openwall oss-security mailing list co-disclosure) reports active exploitation or public proof-of-concept code for any of the eleven 11.0.25 CVEs. Given Tomcat's ubiquity as an internet-facing Java application server, the combination of an unauthenticated DoS vector (CVE-2026-68763), two CVSS-9.8 issues (CVE-2026-65637, CVE-2026-65905), and several authorization-bypass primitives (CVE-2026-65182, CVE-2026-65927, CVE-2026-68525, CVE-2026-66422) makes prompt patching to 11.0.25 / 10.1.59 / 9.0.121 the primary mitigation, with `webapps/examples` removal and `web.xml` constraint-ordering review as interim compensating controls.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1592.002 Gather Victim Host Information: Software
- T1046 Network Service Discovery
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1212 Exploitation for Credential Access
- T1556 Modify Authentication Process
- T1499.003 Endpoint Denial of Service: Application Exhaustion Flood
- T1499.004 Endpoint Denial of Service: Application or System Exploitation

## Sources

- [Apache Tomcat vulnerabilities crash servers (Cyber Security News)](https://cybersecuritynews.com/apache-tomcat-vulnerabilities-crash-servers/)
- [Apache Tomcat 11 Security Advisory](https://tomcat.apache.org/security-11.html)
- [Apache Tomcat 10 Security Advisory (10.1.59 correction)](https://tomcat.apache.org/security-10.html)
- [NVD - CVE-2026-65182](https://nvd.nist.gov/vuln/detail/CVE-2026-65182)
- [NVD - CVE-2026-68569](https://nvd.nist.gov/vuln/detail/CVE-2026-68569)
- [NVD - CVE-2026-68763](https://nvd.nist.gov/vuln/detail/CVE-2026-68763)
- [NVD - CVE-2026-65927](https://nvd.nist.gov/vuln/detail/CVE-2026-65927)
- [NVD - CVE-2026-65637](https://nvd.nist.gov/vuln/detail/CVE-2026-65637)
- [NVD - CVE-2026-68525](https://nvd.nist.gov/vuln/detail/CVE-2026-68525)
- [NVD - CVE-2026-66422](https://nvd.nist.gov/vuln/detail/CVE-2026-66422)
- [NVD - CVE-2026-66299](https://nvd.nist.gov/vuln/detail/CVE-2026-66299)
- [NVD - CVE-2026-65905](https://nvd.nist.gov/vuln/detail/CVE-2026-65905)
- [NVD - CVE-2026-65183](https://nvd.nist.gov/vuln/detail/CVE-2026-65183)
- [NVD - CVE-2026-73180](https://nvd.nist.gov/vuln/detail/CVE-2026-73180)
- [CISA Known Exploited Vulnerabilities Catalog (checked, no Tomcat 11.0.25 CVEs listed as of 2026-08-26)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2159