Apache Tomcat 11.0.x < 11.0.26 Multiple Vulnerabilities

critical Web App Scanning Plugin ID 115547

Synopsis

Description

According to its self-reported version number, the version of Apache Tomcat installed on the remote host is 9.0.0.M1 prior to 9.0.122, 10.1.0-M1 prior to 10.1.60, or 11.0.0-M1 prior to 11.0.26. It is, therefore, affected by multiple vulnerabilities:

- Improper handling of a length parameter allows WebSocket message smuggling when per-message-deflate is used. (CVE-2026-87022)

- Inconsistent interpretation of HTTP/2 requests caused by a regression in the fix for CVE-2026-41293 can trigger a request header mix-up. (CVE-2026-86350)

- The fix for CVE-2026-34500 was incomplete: CLIENT_CERT authentication does not fail as expected in some scenarios with FFM when OCSP soft-fail is disabled. (CVE-2026-86248)

- Due to a concurrency bug, an attacker could trigger a denial of service as a result of lost timeouts for asynchronous WebSocket writes. (CVE-2026-79677)

- A malformed HTTP/2 request could potentially, depending on timing, cause a request from another user to fail. (CVE-2026-78437)

- If the end user did not provide a request body, an AJP processing thread could be pinned, leading to a denial of service. (CVE-2026-78383)

- A busy wait during the sending of a WebSocket close message enables a denial of service attack. (CVE-2026-77791)

- A race condition involving a stale HPACK emitter allows an attacker to inject trailer fields into another user's HTTP/2 request. (CVE-2026-77762)

- Processing the Transfer-Encoding header for an HTTP/1.0 request may allow an attacker to cause a request from another user to fail when Tomcat is located behind a reverse proxy. (CVE-2026-77756)

- Request paths were incorrectly parsed as endpoint templates, allowing the bypass of security constraints for WebSocket endpoints. (CVE-2026-76183)

- When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications use that provider, the realm of the first web application to authenticate a request is used for all web applications. (CVE-2026-75973)

- Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when the certificate uses a keystore. (CVE-2026-73581)

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.