Loading story…
Apache disclosed CVE-2026-43515, an improper-authorization flaw in Tomcat’s handling of security constraints. When multiple constraints specify an HTTP method for the same extension pattern, Tomcat may enforce only the first constraint, potentially allowing intended access restrictions to be applied incorrectly. The issue affects Tomcat 9.0.0.M1–9.0.117, 10.1.0-M1–10.1.54, and 11.0.0-M1–11.0.21; MITRE also lists legacy Tomcat 7.0.0–7.0.109 and 8.5.0–8.5.100 as affected.
Apache also fixed CVE-2026-41293, a low-severity HTTP/2 request-header validation issue that can cause unexpected behavior in applications relying on Servlet API header values being specification-compliant. Organizations should upgrade to Tomcat 9.0.118, 10.1.55, or 11.0.22 or later; unsupported releases should be retired or moved to a supported fixed version. Apache had separately disclosed CVE-2026-32990, identifying an incomplete prior fix for CVE-2025-66614.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Apache disclosed CVE-2026-43513, an improper case-sensitivity handling vulnerability in Tomcat's LockOutRealm component. It affects Tomcat 7.0.0–7.0.109, 8.5.0–8.5.100, 9.0.0.M1–9.0.117, 10.1.0-M1–10.1.54, and 11.0.0-M1–11.0.21; upgrades to 9.0.118, 10.1.55, or 11.0.22 remediate the issue.
Apache disclosed moderate-severity CVE-2026-43515, an improper-authorization issue where only the first HTTP-method constraint may be enforced when multiple constraints apply to the same extension pattern. Apache recommended upgrades to Tomcat 11.0.22, 10.1.55, or 9.0.118; MITRE also listed affected Tomcat 7 and 8.5 versions.
Apache disclosed low-severity CVE-2026-41293, in which HTTP/2 request headers were not properly validated and could cause unexpected application behavior. Affected Tomcat releases were advised to upgrade to 11.0.22, 10.1.55, or 9.0.118 or later.
Apache Tomcat issued a security advisory for CVE-2026-32990, stating that the fix for CVE-2025-66614 was incomplete.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
lists.apache.org
Open sourcelists.apache.org
Open sourcecve.mitre.org
Open sourcelists.apache.org
Open sourcecve.mitre.org
Open sourcelists.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Tomcat released security updates addressing several vulnerabilities across supported branches, including **CVE-2026-59083**, an incorrect URL decoding flaw in `RewriteValve` that can let attackers bypass security constraints in some configurations, and **CVE-2026-59084**, a documentation-related weakness that left `EncryptInterceptor` deployments without clearly defined secure configuration requirements. Apache said affected versions span Tomcat 11, 10.1, 9.0, and 8.5 releases, with some unsupported end-of-life versions potentially exposed as well. Separate Tomcat advisories also described additional patched issues, including **CVE-2026-53434**, an invalid CRL configuration vulnerability rated **CVSS 9.1**, **CVE-2026-50229**, a cross-site scripting flaw in the Number Guess example, and other fixes tracked as **CVE-2026-53404**, **CVE-2026-55276**, **CVE-2026-55955**, and **CVE-2026-55956**. Organizations were urged to test and deploy updated releases, with Apache recommending upgrades to **11.0.24**, **10.1.57**, and **9.0.120** to remediate the newly disclosed issues.
Aug 28, 2026
Apache released Tomcat **11.0.25**, **10.1.58**, and **9.0.121** to remediate 11 vulnerabilities across supported release lines. The most consequential issues include `CVE-2026-68569`, where DataSourceRealm principal lookup can fail open with mechanisms such as CLIENT-CERT or SPNEGO; `CVE-2026-65182`, which can bypass security constraints based on path-rule ordering; and `CVE-2026-65927`, an off-by-one RewriteValve error that may bypass access controls. `CVE-2026-68763` also permits denial of service through an HTTP/2 backlog-tracking allocation leak when streams are reset. The updates additionally address authorization bypasses involving FORM-authentication redirects (`CVE-2026-68525`) and `security-role-ref` aliases (`CVE-2026-66422`), a limited DIGEST-authentication replay condition (`CVE-2026-65905`), an HTTP/2 strict-SNI-validation bypass from an incomplete prior fix (`CVE-2026-65637`), a Unix-domain-socket permission race (`CVE-2026-65183`), and WebSocket sessions that can survive expiration of their associated HTTP session (`CVE-2026-73180`). Organizations should prioritize upgrades, particularly for internet-facing deployments; Tomcat 7 and 8.5 installations are end of life and should be retired or otherwise remediated. No confirmed in-the-wild exploitation or public proof-of-concept code was reported.
Aug 31, 2026
Apache Tomcat remediated a group of vulnerabilities affecting multiple supported release lines. **CVE-2026-55957** allows authentication bypass in `JNDIRealm` deployments that use GSSAPI-authenticated binds, while **CVE-2026-55956** can cause Default Servlet security constraints to incorrectly handle specified HTTP methods or method omissions. **CVE-2026-55955** permits replay attacks against the cluster-component `EncryptionInterceptor`, and **CVE-2026-43514** exposes a timing discrepancy in AJP secret comparison that may aid secret-value inference. Tomcat also corrected **CVE-2026-53434**, in which invalid certificate-revocation-list configuration for an FFM-based connector might not produce an error, and **CVE-2026-55276**, where effective `web.xml` logging could omit special roles and empty authorization constraints. Organizations should upgrade affected deployments to supported fixed releases: generally Tomcat **11.0.23**, **10.1.56**, or **9.0.119** for the June issues; the JNDIRealm authentication-bypass advisory specifies **11.0.5**, **10.1.37**, or **9.0.101**. Tomcat 8.0 and 8.5 are end of life and should be migrated to a supported branch rather than retained without security fixes.
Aug 28, 2026