Reported by 2 outlets
Apache Tomcat Flaw Lets Attackers Bypass Security Constraints on WebSocket Endpoints
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
Apache Tomcat 11.0.26 fixes 12 vulnerabilities affecting versions 11.0.0-M1 through 11.0.25. The most significant, CVE-2026-76183 (Important), allows attackers to bypass security constraints on WebSocket endpoints because Tomcat incorrectly parses request paths as endpoint templates. CVE-2026-87022 is a WebSocket message-smuggling flaw triggered by improper length-parameter handling when per-message-deflate compression is enabled; the fix is in commit 4fef25fe. CVE-2026-77791 creates a busy-wait denial-of-service condition. The release also patches HTTP/2, AJP, authentication, and TLS certificate-validation flaws. Apache does not provide binary patches for individual issues; upgrading to 11.0.26 is the only remediation path. Internet-facing deployments should prioritize this update given the WebSocket bypass risk.
Timeline
-
original reporting
Apache Tomcat Flaw Lets Attackers Bypass Security Constraints on WebSocket Endpoints
cyberpress.org · 19d ago · September 24th, 2026
The Apache Software Foundation has released Apache Tomcat 11.0.26, fixing 12 vulnerabilities across WebSocket, HTTP/2, AJP, authentication, and TLS certificate-validation components . The release is particularly urgent for internet-facing deployments because it includes an Important-rated flaw that can allow attackers to bypass security constraints on WebSocket endpoints. Disclosed publicly on September 23, the issues affect a broad range of Tomcat 11 versions, with most extending from 11.0.0-M1 through 11.0.25. Apache does not issue binary patches for individual flaws, making an upgrade to Tomcat 11.0.26 the primary remediation path. Apache Tomcat Flaw The most significant issue, tracked as CVE-2026-76183, arises from Tomcat incorrectly parsing request paths as WebSocket endpoint templates. This behavior can enable a bypass of security constraints applied to WebSocket endpoints, potentially allowing an unauthorized user to reach services that application developers expected to be access-controlled. The update also fixes CVE-2026-87022, a WebSocket message-smuggling flaw affecting deployments that enable the per-message-deflate compression extension. Improper handling of a length parameter could allow an attacker to smuggle WebSocket messages, creating parsing inconsistencies between components handling the same connection. The correction is available in commit 4fef25fe . Several other WebSocket flaws create denial-of-service conditions . CVE-2026-77791 enables a busy-wait co
-
update from gbhackers.com
Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
gbhackers.com · 19d ago · September 24th, 2026
Dated September 15, 2026, the release addresses flaws that were publicly disclosed […] The post Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .