SB2026092344 - Multiple vulnerabilities in Apache Tomcat

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092344

SB2026092344 - Multiple vulnerabilities in Apache Tomcat

Published: September 23, 2026

Security Bulletin ID SB2026092344
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2026-87022)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to smuggle WebSocket messages.

The vulnerability exists due to improper handling of a length parameter in WebSocket per-message-deflate processing when processing WebSocket messages with per-message-deflate enabled. A remote attacker can send a crafted WebSocket message to smuggle WebSocket messages.

Only WebSocket connections using per-message-deflate are affected.


2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-86350)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a request header mix-up.

The vulnerability exists due to inconsistent interpretation of HTTP/2 requests in HTTP/2 request processing when handling HTTP/2 requests. A remote attacker can send a crafted HTTP/2 request to cause a request header mix-up.

The issue is a regression in the fix for CVE-2026-41293.


3) Improper Certificate Validation (CVE-ID: CVE-2026-86248)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass client certificate authentication.

The vulnerability exists due to improper certificate validation in CLIENT_CERT authentication when validating OCSP status with OCSP soft fail disabled. A remote attacker can present a certificate in affected scenarios to bypass client certificate authentication.

The issue occurs in some scenarios when OCSP soft fail is disabled.


4) Race condition (CVE-ID: CVE-2026-79677)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a concurrency bug in asynchronous WebSocket write handling when performing asynchronous WebSocket writes. A remote attacker can trigger lost write timeouts to cause a denial of service.


5) Resource exhaustion (CVE-ID: CVE-2026-78437)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause another user's request to fail.

The vulnerability exists due to improper handling of malformed HTTP/2 requests in HTTP/2 request processing when handling a malformed HTTP/2 request. A remote attacker can send a malformed HTTP/2 request to cause another user's request to fail.

Successful exploitation depends on timing.


6) Resource exhaustion (CVE-ID: CVE-2026-78383)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of requests without a body in AJP request processing when processing an AJP request without a request body. A remote attacker can send an AJP request without a request body to cause a denial of service.

An affected request can pin an AJP processing thread.


7) Resource exhaustion (CVE-ID: CVE-2026-77791)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a busy wait in WebSocket close message handling when sending a WebSocket close message. A remote attacker can trigger the busy wait to cause a denial of service.


8) Race condition (CVE-ID: CVE-2026-77762)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject trailer fields into another HTTP/2 request.

The vulnerability exists due to a race condition in the HPACK emitter when processing HTTP/2 requests with recycled pooled requests. A remote attacker can trigger the race condition to inject trailer fields into another HTTP/2 request.


9) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-77756)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause another user's request to fail.

The vulnerability exists due to improper handling of the Transfer-Encoding header in HTTP/1.0 request processing when processing an HTTP/1.0 request behind a reverse proxy. A remote attacker can send an HTTP/1.0 request with a Transfer-Encoding header to cause another user's request to fail.

The issue requires Tomcat to be located behind a reverse proxy.


10) Improper access control (CVE-ID: CVE-2026-76183)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass security constraints for WebSocket endpoints.

The vulnerability exists due to incorrect parsing of request paths as endpoint templates in WebSocket endpoint processing when processing a request for a WebSocket endpoint. A remote attacker can send a request with a crafted path to bypass security constraints for WebSocket endpoints.


11) Improper Authentication (CVE-ID: CVE-2026-75973)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause authentication to use another web application's realm.

The vulnerability exists due to improper isolation of authentication realms in Jakarta Authentication when multiple web applications use SimpleAuthConfigProvider as the default provider. A remote user can authenticate to a web application to cause authentication to use another web application's realm.

Authentication uses the realm of the first web application to authenticate a request.


12) Improper Certificate Validation (CVE-ID: CVE-2026-73581)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass certificate revocation checks.

The vulnerability exists due to improper certificate validation in the OpenSSL and OpenSSL-FFM TLS implementations when validating a certificate that uses a keystore. A remote attacker can present a certificate subject to certificate revocation checks to bypass certificate revocation checks.

The issue affects both the OpenSSL and OpenSSL-FFM TLS implementations when the certificate uses a keystore.


Remediation

Install update from vendor's website.

References