The Apache Software Foundation has released Tomcat 11.0.26, an Apache Tomcat Update that resolves 12 security vulnerabilities. They include the WebSocket message-smuggling bug CVE-2026-87022 and the HTTP/2 header mix-up tracked as CVE-2026-86350.
The fixes, disclosed on September 23, 2026, cover WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation. Four flaws are rated Important, three Moderate, and five Low.
Apache Tomcat Update-Who Needs It
Most Tomcat 11 deployments are exposed. Many of the issues affect versions 11.0.0-M1 through 11.0.25, while narrower flaws start at 11.0.0-M5, 11.0.0-M14, 11.0.19 or 11.0.22. Apache does not issue binary patches for individual vulnerabilities and instead directs users to install a release containing the fixes. That makes 11.0.26 the practical minimum for remediation.
How CVE-2026-87022 Enables WebSocket Smuggling
CVE-2026-87022 comes from improper handling of a length parameter when per-message-deflate compression is enabled. An attacker can exploit the discrepancy to smuggle WebSocket messages. Every release from 11.0.0-M1 through 11.0.25 is affected, and the correction is in commit 4fef25fe.
CVE-2026-86350 and Other HTTP/2 Defects
CVE-2026-86350 is the higher-priority HTTP/2 issue. It is a regression introduced during the fix for CVE-2026-41293. Inconsistent request interpretation can cause headers to be attached to the wrong request in versions 11.0.22 through 11.0.25.
Two related HTTP/2 bugs were also fixed. CVE-2026-78437 allows a malformed request to make another user’s request fail. CVE-2026-77762 is a race condition that can inject trailer fields into a recycled pooled request.
Denial-of-Service and Authorization Risks
Several fixes address availability. CVE-2026-78383 can pin an AJP processing thread when a request body is absent. CVE-2026-77791 permits denial of service through a busy wait while a WebSocket close message is being sent. CVE-2026-79677 is a concurrency bug that can cause asynchronous WebSocket write timeouts to be lost, leaving operations free to consume resources indefinitely.
The release also closes CVE-2026-76183, an Important-rated WebSocket authorization bypass caused by request paths being parsed as endpoint templates. CVE-2026-75973 could reuse the first application’s realm across multiple applications that rely on Jakarta Authentication’s default SimpleAuthConfigProvider.
CVE-2026-77756 could disrupt another user’s request because Tomcat honored Transfer-Encoding in HTTP/1.0 traffic behind a reverse proxy.
Certificate Validation Repairs
Two fixes concern certificate checking. CVE-2026-86248 completes an earlier, incomplete OCSP fix. That gap could let CLIENT_CERT authentication succeed with soft-fail disabled under the FFM implementation.
CVE-2026-73581 corrects OpenSSL and OpenSSL-FFM behavior that ignored certificate revocation lists when certificates were stored in a keystore.
Rolling Out the Apache Tomcat Update Safely
Administrators are advised to take the following steps:
- Inventory every Tomcat 11 instance.
- Prioritize externally reachable WebSocket, HTTP/2 and AJP connectors.
- Upgrade to 11.0.26 after testing application compatibility.
- Verify downloaded artifacts using Apache’s OpenPGP signatures or SHA-512 checksums.
- Review reverse-proxy and authentication configurations.
- Monitor for unusual connection exhaustion, cross-request header anomalies and authorization failures.
Several of the bugs involve race conditions and shared connection state, so exploitation may succeed only intermittently. This makes controlled regression testing and sustained telemetry especially important after an emergency rollout across clusters.
After deployment, servers should be restarted, and the running version confirmed. Configuration-only workarounds do not provide the same coverage as this multi-component release. Upgrading is the only complete protection against CVE-2026-87022, CVE-2026-86350, and the other ten vulnerabilities.
