Apache Tomcat Updates Patch 11 Flaws Enabling Access Bypass and Denial of Service

Apache released Tomcat 11.0.25, 10.1.58, and 9.0.121 to remediate 11 vulnerabilities across supported release lines. The most consequential issues include CVE-2026-68569, where DataSourceRealm principal lookup can fail open with mechanisms such as CLIENT-CERT or SPNEGO; CVE-2026-65182, which can bypass security constraints based on path-rule ordering; and CVE-2026-65927, an off-by-one RewriteValve error that may bypass access controls. CVE-2026-68763 also permits denial of service through an HTTP/2 backlog-tracking allocation leak when streams are reset.

The updates additionally address authorization bypasses involving FORM-authentication redirects (CVE-2026-68525) and security-role-ref aliases (CVE-2026-66422), a limited DIGEST-authentication replay condition (CVE-2026-65905), an HTTP/2 strict-SNI-validation bypass from an incomplete prior fix (CVE-2026-65637), a Unix-domain-socket permission race (CVE-2026-65183), and WebSocket sessions that can survive expiration of their associated HTTP session (CVE-2026-73180). Organizations should prioritize upgrades, particularly for internet-facing deployments; Tomcat 7 and 8.5 installations are end of life and should be retired or otherwise remediated. No confirmed in-the-wild exploitation or public proof-of-concept code was reported.