Loading vulnerability…
Apache Tomcat Longest-Prefix Security Constraint Bypass
CVE-2026-65182 is an incorrect authorization vulnerability in Apache Tomcat's selection of web-application security constraints. When a constraint for a longer path is declared before a more restrictive constraint for a shorter sub-path, Tomcat may bypass the intended security constraint, permitting unauthorized access to protected resources. Affected versions are 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote attackers may bypass application security constraints and access protected content or functionality without the required authorization. Confidentiality can be compromised through unauthorized disclosure; integrity may also be affected where exposed functionality permits changes. The precise impact depends on the affected application's resources and constraint configuration. Vulnerability-specific assessments identify no direct availability impact.
If you can’t patch tonight, do this now.
Review overlapping web-application security constraints and avoid declaring a longer-path constraint before a more restrictive constraint for its shorter sub-path. Validate authorization behavior for the affected URL patterns after configuration changes. Until patched, restrict network exposure and enforce independent access controls on protected application resources.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.25 or later, 10.1.58 or later, or 9.0.121 or later within the corresponding release branch. Migrate affected Tomcat 7 and 8.5 deployments to a supported fixed branch because no fixed releases are identified for those branches. For products bundling Tomcat, apply the vendor's corrected product release or package update rather than independently replacing embedded dependencies. Identified fixed product releases include Confluence 9.2.26, 10.2.19, and 11.0.0, and Red Hat JBoss Web Server 6.2.5 and 7.0.2.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.