erroneo.us
Search all guides⌘K

Security Digest · Aug 25, 2026 · Vulnerability · Web framework

Apache Tomcat August 2026: Security Constraint Bypasses

Tomcat 11.0.25, 10.1.59 and 9.0.121 fix 11 CVEs, incl. constraint and auth bypasses CISA scores 9.1-9.8. Apache rates them lower. Patch this week.

Published By erroneo.us Security Desk · Updated 4 min read11 sources

Our verdict

Patch this week

Upgrade Tomcat, including the copy embedded in Spring Boot apps, this week; the access-control bypasses matter wherever you rely on web.xml security constraints or container authentication, and none is known to be exploited.

Who must act: Anyone running Tomcat 9.0, 10.1 or 11.0, standalone or embedded, that relies on declarative security constraints, FORM or DIGEST authentication, CLIENT-CERT or SPNEGO with DataSourceRealm or JDBCRealm, or RewriteValve rules for access control.

Who can relax: Applications that enforce authorization in their own code rather than in Tomcat security constraints, and that use none of the affected authenticators or the RewriteValve, have little exposure and can patch on a normal cycle.

Affected
Apache Tomcat 11.0.0-M1 through 11.0.24
Apache Tomcat 10.1.0-M1 through 10.1.57
Apache Tomcat 9.0.0.M1 through 9.0.120
Apache Tomcat 8.5.0-8.5.100 and 7.0.x (end of life; affected, no fix)
Spring Boot 4.0.8 and 4.1.1 (pin tomcat-embed-core 11.0.24)
Fixed in
Apache Tomcat 11.0.25 (Aug 18, 2026)
Apache Tomcat 10.1.59 (Aug 20, 2026; 10.1.58 was never released)
Apache Tomcat 9.0.121 (Aug 18, 2026)
CVSS
9.1 (v3.1, CISA-ADP)
EPSS
0.7% (percentile 54)
CISA KEV
Not listed
Exploitation
No known exploitation
Severity
High

What to do

  1. Find every Tomcat, including tomcat-embed-core inside Spring Boot and other fat JARs, and record its version.
  2. Upgrade standalone servers to 11.0.25, 10.1.59 or 9.0.121 or later and restart.
  3. For Spring Boot apps, override the managed Tomcat version (Maven property tomcat.version) to a fixed release, rebuild and redeploy; the latest Boot releases still ship 11.0.24.
  4. Move Tomcat 8.5 and 7.0 installs to a supported line; they are affected and get no fix.
  5. Review web.xml for overlapping url-pattern constraints, POST-only constraints behind FORM login, DIGEST auth, and RewriteValve rules used for access control.

How to check if you are affected or compromised

  • Run bin/version.sh (or catalina.sh version), and for embedded builds mvn dependency:tree -Dincludes=org.apache.tomcat.embed or ./gradlew dependencyInsight --dependency tomcat-embed-core.
  • Check access logs for 200 responses to protected sub-paths from requests that never authenticated or lacked the required role.
  • Where DIGEST auth is used, look for repeated Authorization headers with the same nonce and nc value from different clients or times.

What happened#

On August 25, 2026, the Apache Tomcat team made public 11 vulnerabilities fixed in Tomcat 11.0.25 and 9.0.121 (both released August 18) and in 10.1.59 (released August 20). The 10.1.58 release candidate failed its vote, so 10.1.59 is the first fixed 10.1 build, even though the CVE text says 10.1.58. That version is not on Maven Central.

Three of the CVEs drew critical scores from CISA's enrichment, and they are what pushed this release into advisory feeds:

  • CVE-2026-65182, security constraint bypass. If a constraint for a longer path is declared before a more restrictive constraint for a shorter sub-path, the restriction can be bypassed. Apache rates it Important, and CISA-ADP scores it 9.1.
  • CVE-2026-68525, FORM authentication redirect. The FORM login flow can bypass a constraint that limits a user to POST but not GET on a resource. Apache rates it Low, and CISA-ADP scores it 9.1.
  • CVE-2026-65905, DIGEST replay. A DIGEST request whose nonceCount sits on the upper boundary of the replay window, sent before windowSize requests have been made, can be replayed once. Apache rates it Low, and CISA-ADP scores it 9.8.

The same releases fix three more issues Apache rates Important. CVE-2026-68569 lets CLIENT-CERT or SPNEGO users authenticate even if they do not exist in a DataSourceRealm (and JDBCRealm on 9.0). CVE-2026-65927 is an off-by-one in the RewriteValve [N] flag that restarts processing at the second rule and may bypass access control. CVE-2026-68763 is an HTTP/2 denial of service. The researchers credited for the three headline bugs are 4ra1n, pyn3rd and unam4.

Who is affected#

The affected lines are Tomcat 11.0.0-M1 to 11.0.24, 10.1.0-M1 to 10.1.57 and 9.0.0.M1 to 9.0.120, along with the matching tomcat-embed-core artifacts. Tomcat 8.5 and 7.0 are end of life and also affected, according to the CVE records. Spring Boot apps carry Tomcat inside the JAR. The newest Spring Boot releases on Maven Central as of October 21, 4.0.8 and 4.1.1 (both August 20), still pin tomcat.version 11.0.24. Upgrading Spring Boot alone does not fix this yet.

Do you really need to act?#

Yes, but this is a this-week patch, not a fire drill. The scores disagree sharply. NVD shows the CISA-ADP 9.1 for CVE-2026-65182, while the project's announcement calls it important. The other two "critical" CVEs Apache calls low. CISA's enrichment records exploitation as "none" for all three, and none is in KEV. These CVEs should not be confused with CVE-2026-34486, an earlier, unrelated Tomcat bug that is in KEV.

Exposure depends on configuration. The constraint bypass needs overlapping url-pattern constraints in a particular order. The FORM bug needs method-specific constraints. DIGEST is uncommon, and the replay works only once. The realm bug needs CLIENT-CERT or SPNEGO with a database realm. Apps that enforce authorization in their own code are largely outside these paths. Even so, the fix is a drop-in patch release, and these are the kinds of controls you only find out you relied on after they fail.

What to do now#

  1. Inventory: run $CATALINA_HOME/bin/version.sh on servers. For builds, run mvn dependency:tree -Dincludes=org.apache.tomcat.embed or ./gradlew dependencyInsight --dependency tomcat-embed-core.
  2. Upgrade standalone Tomcat to 11.0.25, 10.1.59 or 9.0.121 or later, then restart.
  3. For Spring Boot, set the managed version as the Spring Boot plugin docs describe, for example <properties><tomcat.version>11.0.25</tomcat.version></properties>. Then rebuild, redeploy, and confirm the version in the built JAR.
  4. Plan moves off 8.5 and 7.0, which get no fix.
  5. Review web.xml for overlapping constraints, POST-only constraints behind FORM login, DIGEST realms, and RewriteValve rules that gate access.

How to tell if you were hit#

No exploitation has been reported, and these bugs leave no signature of their own. Look at outcomes instead. Search access logs for successful responses to protected sub-paths from sessions that never authenticated or lacked the required role. Check for GET requests that reached POST-only resources right after a FORM login. Where DIGEST is in use, look for identical Authorization headers (same nonce and nc) arriving more than once. If you used CLIENT-CERT or SPNEGO with a database realm, compare authenticated principals against the users that actually exist in the realm.

Timeline#

  • — CVE-2026-65182 and CVE-2026-65905 are reported to the Tomcat security team. CVE-2026-68525 follows on July 15.
  • — Tomcat 11.0.25 and 9.0.121 are released.
  • — Tomcat 10.1.59 is released after the 10.1.58 vote fails. Spring Boot 4.0.8 and 4.1.1 ship, still on Tomcat 11.0.24.
  • — The issues are made public and the CVE records are published.
  • — The announcements reach oss-security. GitHub publishes GHSA-gcx9-497g-6cp6 and related advisories rated critical.

Vulnerability records

  • CVE-2026-65182 · Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is…
  • CVE-2026-68525 · Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access…
  • CVE-2026-65905 · Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator.
  • CVE-2026-68569 · Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g.
  • CVE-2026-65927 · Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather…
  • CVE-2026-68763 · Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Apache Tomcat — Apache Tomcat 11.x vulnerabilities (Fixed in 11.0.25) tomcat.apache.org
  2. Apache Tomcat — Apache Tomcat 10.x vulnerabilities (Fixed in 10.1.59) tomcat.apache.org
  3. Apache Tomcat — Apache Tomcat 9.x vulnerabilities (Fixed in 9.0.121) tomcat.apache.org
  4. CVE record — CVE-2026-65182 cve.org
  5. CVE record — CVE-2026-68525 cve.org
  6. CVE record — CVE-2026-65905 cve.org
  7. NVD — CVE-2026-65182 nvd.nist.gov
  8. oss-security — CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint openwall.com
  9. GitHub Advisory Database — GHSA-gcx9-497g-6cp6 github.com
  10. Maven Central — spring-boot-dependencies 4.1.1 POM repo1.maven.org
  11. Spring Boot — Maven plugin: Using the plugin (overriding managed versions) docs.spring.io