Loading story…
Apache disclosed multiple Tomcat vulnerabilities affecting supported 11.0.x, 10.1.x, and 9.0.x branches, including CVE-2026-43515, a moderate improper authorization flaw that can cause security constraints to be applied incorrectly when multiple method constraints define the same HTTP method for an extension, and CVE-2026-41284, a low-severity resource-consumption issue caused by unbounded reads in WebDAV LOCK and PROPFIND handling. Apache said the WebDAV flaw stems from missing request-body limits on methods accessible to unauthenticated users, and advised upgrades to 11.0.22, 10.1.55, or 9.0.118 to address the newly disclosed issues; older unsupported branches may also be affected.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Atlassian said Jira Service Management Data Center and Server are affected by CVE-2026-34483, with the vulnerable Tomcat component introduced in version 11.3.0. It recommended upgrading to fixed supported releases including 11.3.5 or 10.3.20.
Apache disclosed CVE-2026-43515, a moderate improper authorization flaw where overlapping method constraints for the same extension could cause security constraints to be applied incorrectly. The company advised upgrading affected Tomcat installations to 11.0.22, 10.1.55, or 9.0.118.
Apache disclosed CVE-2026-41284, a low-severity unbounded read issue in WebDAV LOCK and PROPFIND handling caused by missing request body limits for unauthenticated methods. The advisory said affected Tomcat branches include 11.0.x, 10.1.x, and 9.0.x, and recommended upgrading to 11.0.22, 10.1.55, or 9.0.118.
Atlassian published an advisory stating that Jira Software Data Center and Server are affected by CVE-2026-34483, introduced in version 11.3.0. The company recommended upgrading to fixed supported releases including 11.3.5 or later and 10.3.20 or later.
Atlassian reported that CVE-2026-34483 affects Confluence Data Center and Server through its bundled Apache Tomcat dependency. It said affected Confluence versions span 8.9.0 through 10.2.0 and directed customers to upgrade to supported fixed releases including 10.2.11 and 9.2.20 or later.
Apache published a security advisory for CVE-2026-34483, an incomplete escaping flaw in Tomcat's JSON access logging component. The issue affects multiple Tomcat branches and was later referenced by downstream vendors as fixed in Tomcat 11.0.21, 10.1.54, and 9.0.117.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
9 references tracked. Mallory keeps watching after this page renders.
jira.atlassian.com
Open sourceseclists.org
Open sourceseclists.org
Open sourcelists.apache.org
Open sourcecve.mitre.org
Open sourcejira.atlassian.com
Open sourcejira.atlassian.com
Open sourcejira.atlassian.com
Open sourcejira.atlassian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-43515**, an improper-authorization flaw in Tomcat’s handling of security constraints. When multiple constraints specify an HTTP method for the same extension pattern, Tomcat may enforce only the first constraint, potentially allowing intended access restrictions to be applied incorrectly. The issue affects Tomcat 9.0.0.M1–9.0.117, 10.1.0-M1–10.1.54, and 11.0.0-M1–11.0.21; MITRE also lists legacy Tomcat 7.0.0–7.0.109 and 8.5.0–8.5.100 as affected. Apache also fixed **CVE-2026-41293**, a low-severity HTTP/2 request-header validation issue that can cause unexpected behavior in applications relying on Servlet API header values being specification-compliant. Organizations should upgrade to Tomcat **9.0.118**, **10.1.55**, or **11.0.22** or later; unsupported releases should be retired or moved to a supported fixed version. Apache had separately disclosed **CVE-2026-32990**, identifying an incomplete prior fix for CVE-2025-66614.
Aug 28, 2026
Apache released Tomcat **11.0.25**, **10.1.58**, and **9.0.121** to remediate 11 vulnerabilities across supported release lines. The most consequential issues include `CVE-2026-68569`, where DataSourceRealm principal lookup can fail open with mechanisms such as CLIENT-CERT or SPNEGO; `CVE-2026-65182`, which can bypass security constraints based on path-rule ordering; and `CVE-2026-65927`, an off-by-one RewriteValve error that may bypass access controls. `CVE-2026-68763` also permits denial of service through an HTTP/2 backlog-tracking allocation leak when streams are reset. The updates additionally address authorization bypasses involving FORM-authentication redirects (`CVE-2026-68525`) and `security-role-ref` aliases (`CVE-2026-66422`), a limited DIGEST-authentication replay condition (`CVE-2026-65905`), an HTTP/2 strict-SNI-validation bypass from an incomplete prior fix (`CVE-2026-65637`), a Unix-domain-socket permission race (`CVE-2026-65183`), and WebSocket sessions that can survive expiration of their associated HTTP session (`CVE-2026-73180`). Organizations should prioritize upgrades, particularly for internet-facing deployments; Tomcat 7 and 8.5 installations are end of life and should be retired or otherwise remediated. No confirmed in-the-wild exploitation or public proof-of-concept code was reported.
Aug 31, 2026
Apache Tomcat released security updates addressing several vulnerabilities across supported branches, including **CVE-2026-59083**, an incorrect URL decoding flaw in `RewriteValve` that can let attackers bypass security constraints in some configurations, and **CVE-2026-59084**, a documentation-related weakness that left `EncryptInterceptor` deployments without clearly defined secure configuration requirements. Apache said affected versions span Tomcat 11, 10.1, 9.0, and 8.5 releases, with some unsupported end-of-life versions potentially exposed as well. Separate Tomcat advisories also described additional patched issues, including **CVE-2026-53434**, an invalid CRL configuration vulnerability rated **CVSS 9.1**, **CVE-2026-50229**, a cross-site scripting flaw in the Number Guess example, and other fixes tracked as **CVE-2026-53404**, **CVE-2026-55276**, **CVE-2026-55955**, and **CVE-2026-55956**. Organizations were urged to test and deploy updated releases, with Apache recommending upgrades to **11.0.24**, **10.1.57**, and **9.0.120** to remediate the newly disclosed issues.
Aug 28, 2026