CVE-2026-76183 – Apache Tomcat
“When the gatekeeper can be talked past, every application behind it is open to the wrong person.”
Apache Tomcat versions 11.0.26, 10.1.60, and 9.0.122 fix five authentication and request-handling flaws, and three of them are rated Critical. CVE-2026-76183 has a CVSS score of 9.8, Critical severity, and lets attackers bypass security constraints on any WebSocket endpoint. CVE-2026-86248 has a CVSS score of 9.8, Critical severity, and stops CLIENT_CERT authentication from failing as it should in some cases when soft fail is disabled. CVE-2026-86350 has a CVSS score of 9.1, Critical severity: an HTTP/2 request smuggling regression can mix up request headers between requests.
Two High severity flaws complete the update. CVE-2026-77762 has a CVSS score of 8.1, High severity: a race condition lets an attacker inject trailer fields into another user's HTTP/2 request. CVE-2026-75973 has a CVSS score of 7.3, High severity: when several web applications share the SimpleAuthConfigProvider for Jakarta Authentication, all of them can end up using the realm of the first application to authenticate a request. The affected releases cover the 11.0, 10.1, and 9.0 branches. End-of-life 8.5 releases, and for the WebSocket flaw 7.0 releases, are also affected and will not receive a fix, so organizations should move those servers to a supported branch.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-289