Apache Tomcat Updates Address Twelve Security Flaws

Quick Answer

Apache Tomcat 11.0.26, 10.1.60 and 9.0.122 contain the twelve fixes covered here. They address different paths: client-certificate revocation, shared authentication realms, WebSocket authorization and resource handling, HTTP parsing/concurrency, and AJP thread exhaustion. Match both the branch and enabled feature. Unsupported 7.0 and 8.5 deployments need a supported migration, not an assumption that an old final release includes these fixes.

Source recheck: October 2, 2026 UTC, against Apache's 11.0, 10.1 and 9.0 security pages. These branch pages clarify the CRL range; no runtime tests were performed for this article.

Scope And Authority

Product scope	Apache Tomcat 11.0 through 11.0.25, 10.1 through affected 10.1.59 releases, 9.0 through 9.0.121, plus advisory-specific end-of-life 8.5 and 7.0 releases
Advisory	CVE-2026-73581 / CVE-2026-75973 / CVE-2026-76183 / CVE-2026-77756 / CVE-2026-77762 / CVE-2026-77791 / CVE-2026-78383 / CVE-2026-78437 / CVE-2026-79677 / CVE-2026-86248 / CVE-2026-86350 / CVE-2026-87022
CVEs	CVE-2026-73581, CVE-2026-75973, CVE-2026-76183, CVE-2026-77756, CVE-2026-77762, CVE-2026-77791, CVE-2026-78383, CVE-2026-78437, CVE-2026-79677, CVE-2026-86248, CVE-2026-86350, CVE-2026-87022
Authoritative release date	2026-09-23 11:08:53.212 UTC
Authority revision date	2026-09-23 16:14:59.897 UTC
Affected versions	Apache Tomcat 11.0 through 11.0.25, 10.1 through affected 10.1.59 releases, 9.0 through 9.0.121, plus advisory-specific end-of-life 8.5 and 7.0 releases
Fixed version	Apache Tomcat 11.0.26, 10.1.60, or 9.0.122; migrate unsupported 7.0 and 8.5 deployments to a supported branch
CVSS base score	Not provided by the authority
CVSS severity	Low to Important
Exploitation status	Not stated by the authority; no exploitation claim is inferred.

What Changed

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59 (current Tomcat 10.1 security page; the earlier CNA-derived range ended at 10.1.58), from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected. Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected. Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.88 through 8.5.100. Other unsupported versions may also be affected. Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121. Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected.

What To Validate Now

1. Inventory. Record active Tomcat build and JVM, embedded-vendor ownership, AJP/HTTP/2/WebSocket use, reverse-proxy routes, SimpleAuthConfigProvider sharing, and OpenSSL/OpenSSL-FFM certificate/CRL/OCSP configuration.
2. Establish applicability. Compare each deployment with the authority's affected-version statement: Apache Tomcat 11.0 through 11.0.25, 10.1 through affected 10.1.59 releases, 9.0 through 9.0.121, plus advisory-specific end-of-life 8.5 and 7.0 releases Do not infer applicability from product family or severity alone.
3. Remediate. Apply Apache Tomcat 11.0.26, 10.1.60, or 9.0.122; migrate unsupported 7.0 and 8.5 deployments to a supported branch through the supported vendor or project channel, following the current advisory and change-control requirements.
4. Validate. In staging, verify WebSocket authorization, close/write behavior, proxy request isolation and normal AJP traffic where enabled. For client-certificate deployments, check valid, revoked and unavailable-revocation-response cases using a test CA and the intended fail-closed policy. Do not run request-smuggling or resource-exhaustion probes against production.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

Keep the per-CVE starting ranges below the summary in view: several HTTP/2 issues are recent regressions rather than defects in every historical release. Restrict unused connectors, but do not assume disabling one protocol addresses the authentication or certificate fixes. A major-branch migration also needs application/JVM compatibility testing; do not swap an embedded Tomcat behind its vendor's back.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• CVE-2026-73581
• CVE-2026-75973
• CVE-2026-76183
• CVE-2026-77756
• CVE-2026-77762
• CVE-2026-77791
• CVE-2026-78383
• CVE-2026-78437
• CVE-2026-79677
• CVE-2026-86248
• CVE-2026-86350
• CVE-2026-87022

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.