Apache Tomcat 9.0.x < 9.0.121 Multiple Vulnerabilities

critical Web App Scanning Plugin ID 115351

Language:

Synopsis

Description

The version of Apache Tomcat installed on the remote host is prior to 9.0.121, 10.1.59, or 11.0.25. It is, therefore, affected by multiple vulnerabilities :

- The security constraint processing enabled a security constraint bypass if a constraint for a longer path was specified before a more restrictive constraint for a shorter sub-path. (CVE-2026-65182)

- A race condition (TOCTOU) when creating a Unix Domain Socket allowed an unauthorized local user to access the Unix Domain Socket. (CVE-2026-65183)

- An incomplete fix for CVE-2026-32990 allowed HTTP/2 no-authority requests to bypass strict SNI validation. (CVE-2026-65637)

- A limited replay attack was possible with DIGEST authentication if a client made an authenticated request with a nonceCount on the upper boundary of the replay window before windowSize requests had been made. (CVE-2026-65905)

- An off-by-one error in the RewriteValve [N] flag caused rewrite processing to restart at the second rule rather than the first, potentially allowing an attacker to bypass access control. (CVE-2026-65927)

- The WebSocket chat example provided an unbounded buffer for undelivered messages, allowing a maliciously slow client to cause memory exhaustion and failure of the Tomcat process. (CVE-2026-66299)

- security-role-ref definitions were incorrectly used as role aliases within the Realm, allowing servlet role references to bypass declarative role constraints. (CVE-2026-66422)

- The FORM authentication process allowed the bypassing of a security constraint that limited user access to a resource via POST but not GET. (CVE-2026-68525)

- For some authentication methods (e.g., CLIENT-CERT, SPNEGO), a user would be authenticated even if the user did not exist in the DataSourceRealm or JDBCRealm. (CVE-2026-68569)

- An allocation leak in HTTP/2 backlog tracking when a stream was reset could be manipulated to trigger a denial of service. (CVE-2026-68763)

- If the session ID for an authenticated HTTP session was changed after a WebSocket connection was established, the WebSocket session was not closed when the HTTP session ended as required by the Jakarta WebSocket specification. (CVE-2026-73180)

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.