---
title: "Apache Tomcat August 2026: Security Constraint Bypasses"
url: https://erroneo.us/security/briefs/apache-tomcat-august-2026-security-constraint-bypasses/
description: "Tomcat 11.0.25, 10.1.59 and 9.0.121 fix 11 CVEs, incl. constraint and auth bypasses CISA scores 9.1-9.8. Apache rates them lower. Patch this week."
type: security-brief
section: "Security Digest"
date_published: 2026-08-25
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-65182", "CVE-2026-68525", "CVE-2026-65905", "CVE-2026-68569", "CVE-2026-65927", "CVE-2026-68763"]
severity: "high"
exploited: "none-known"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Apache Tomcat August 2026: Security Constraint Bypasses

**Verdict: Patch this week.** Upgrade Tomcat, including the copy embedded in Spring Boot apps, this week; the access-control bypasses matter wherever you rely on web.xml security constraints or container authentication, and none is known to be exploited.

- **Who must act:** Anyone running Tomcat 9.0, 10.1 or 11.0, standalone or embedded, that relies on declarative security constraints, FORM or DIGEST authentication, CLIENT-CERT or SPNEGO with DataSourceRealm or JDBCRealm, or RewriteValve rules for access control.
- **Who can relax:** Applications that enforce authorization in their own code rather than in Tomcat security constraints, and that use none of the affected authenticators or the RewriteValve, have little exposure and can patch on a normal cycle.
- **Affected:** Apache Tomcat 11.0.0-M1 through 11.0.24; Apache Tomcat 10.1.0-M1 through 10.1.57; Apache Tomcat 9.0.0.M1 through 9.0.120; Apache Tomcat 8.5.0-8.5.100 and 7.0.x (end of life; affected, no fix); Spring Boot 4.0.8 and 4.1.1 (pin tomcat-embed-core 11.0.24)
- **Fixed:** Apache Tomcat 11.0.25 (Aug 18, 2026); Apache Tomcat 10.1.59 (Aug 20, 2026; 10.1.58 was never released); Apache Tomcat 9.0.121 (Aug 18, 2026)
- **CVEs:** CVE-2026-65182, CVE-2026-68525, CVE-2026-65905, CVE-2026-68569, CVE-2026-65927, CVE-2026-68763
- **CISA KEV:** no · **Exploitation:** No known exploitation

## What to do

1. Find every Tomcat, including tomcat-embed-core inside Spring Boot and other fat JARs, and record its version.
2. Upgrade standalone servers to 11.0.25, 10.1.59 or 9.0.121 or later and restart.
3. For Spring Boot apps, override the managed Tomcat version (Maven property tomcat.version) to a fixed release, rebuild and redeploy; the latest Boot releases still ship 11.0.24.
4. Move Tomcat 8.5 and 7.0 installs to a supported line; they are affected and get no fix.
5. Review web.xml for overlapping url-pattern constraints, POST-only constraints behind FORM login, DIGEST auth, and RewriteValve rules used for access control.

### How to check if you are affected

- Run bin/version.sh (or catalina.sh version), and for embedded builds mvn dependency:tree -Dincludes=org.apache.tomcat.embed or ./gradlew dependencyInsight --dependency tomcat-embed-core.
- Check access logs for 200 responses to protected sub-paths from requests that never authenticated or lacked the required role.
- Where DIGEST auth is used, look for repeated Authorization headers with the same nonce and nc value from different clients or times.

## What happened

On August 25, 2026, the Apache Tomcat team made public 11 vulnerabilities fixed in [Tomcat 11.0.25](https://tomcat.apache.org/security-11.html) and [9.0.121](https://tomcat.apache.org/security-9.html) (both released August 18) and in [10.1.59](https://tomcat.apache.org/security-10.html) (released August 20). The 10.1.58 release candidate failed its vote, so 10.1.59 is the first fixed 10.1 build, even though the CVE text says 10.1.58. That version is not on Maven Central.

Three of the CVEs drew critical scores from CISA's enrichment, and they are what pushed this release into advisory feeds:

- **CVE-2026-65182, security constraint bypass.** If a constraint for a longer path is declared before a more restrictive constraint for a shorter sub-path, the restriction can be bypassed. Apache rates it *Important*, and CISA-ADP scores it 9.1.
- **CVE-2026-68525, FORM authentication redirect.** The FORM login flow can bypass a constraint that limits a user to POST but not GET on a resource. Apache rates it *Low*, and CISA-ADP scores it 9.1.
- **CVE-2026-65905, DIGEST replay.** A DIGEST request whose nonceCount sits on the upper boundary of the replay window, sent before `windowSize` requests have been made, can be replayed once. Apache rates it *Low*, and CISA-ADP scores it 9.8.

The same releases fix three more issues Apache rates *Important*. CVE-2026-68569 lets CLIENT-CERT or SPNEGO users authenticate even if they do not exist in a DataSourceRealm (and JDBCRealm on 9.0). CVE-2026-65927 is an off-by-one in the RewriteValve `[N]` flag that restarts processing at the second rule and may bypass access control. CVE-2026-68763 is an HTTP/2 denial of service. The researchers credited for the three headline bugs are 4ra1n, pyn3rd and unam4.

## Who is affected

The affected lines are Tomcat 11.0.0-M1 to 11.0.24, 10.1.0-M1 to 10.1.57 and 9.0.0.M1 to 9.0.120, along with the matching `tomcat-embed-core` artifacts. Tomcat 8.5 and 7.0 are end of life and also affected, according to the [CVE records](https://www.cve.org/CVERecord?id=CVE-2026-68525). Spring Boot apps carry Tomcat inside the JAR. The newest Spring Boot releases on Maven Central as of October 21, 4.0.8 and 4.1.1 (both August 20), still pin [`tomcat.version` 11.0.24](https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/4.1.1/spring-boot-dependencies-4.1.1.pom). Upgrading Spring Boot alone does not fix this yet.

## Do you really need to act?

Yes, but this is a this-week patch, not a fire drill. The scores disagree sharply. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-65182) shows the CISA-ADP 9.1 for CVE-2026-65182, while the [project's announcement](https://www.openwall.com/lists/oss-security/2026/08/26/1) calls it important. The other two "critical" CVEs Apache calls low. CISA's enrichment records exploitation as "none" for all three, and none is in KEV. These CVEs should not be confused with CVE-2026-34486, an earlier, unrelated Tomcat bug that is in KEV.

Exposure depends on configuration. The constraint bypass needs overlapping `url-pattern` constraints in a particular order. The FORM bug needs method-specific constraints. DIGEST is uncommon, and the replay works only once. The realm bug needs CLIENT-CERT or SPNEGO with a database realm. Apps that enforce authorization in their own code are largely outside these paths. Even so, the fix is a drop-in patch release, and these are the kinds of controls you only find out you relied on after they fail.

## What to do now

1. Inventory: run `$CATALINA_HOME/bin/version.sh` on servers. For builds, run `mvn dependency:tree -Dincludes=org.apache.tomcat.embed` or `./gradlew dependencyInsight --dependency tomcat-embed-core`.
2. Upgrade standalone Tomcat to 11.0.25, 10.1.59 or 9.0.121 or later, then restart.
3. For Spring Boot, set the managed version as the [Spring Boot plugin docs](https://docs.spring.io/spring-boot/maven-plugin/using.html) describe, for example `<properties><tomcat.version>11.0.25</tomcat.version></properties>`. Then rebuild, redeploy, and confirm the version in the built JAR.
4. Plan moves off 8.5 and 7.0, which get no fix.
5. Review `web.xml` for overlapping constraints, POST-only constraints behind FORM login, DIGEST realms, and RewriteValve rules that gate access.

## How to tell if you were hit

No exploitation has been reported, and these bugs leave no signature of their own. Look at outcomes instead. Search access logs for successful responses to protected sub-paths from sessions that never authenticated or lacked the required role. Check for GET requests that reached POST-only resources right after a FORM login. Where DIGEST is in use, look for identical `Authorization` headers (same nonce and `nc`) arriving more than once. If you used CLIENT-CERT or SPNEGO with a database realm, compare authenticated principals against the users that actually exist in the realm.

## Timeline

- Jul 13, 2026 — CVE-2026-65182 and CVE-2026-65905 are reported to the Tomcat security team. CVE-2026-68525 follows on July 15.
- Aug 18, 2026 — Tomcat 11.0.25 and 9.0.121 are released.
- Aug 20, 2026 — Tomcat 10.1.59 is released after the 10.1.58 vote fails. Spring Boot 4.0.8 and 4.1.1 ship, still on Tomcat 11.0.24.
- Aug 25, 2026 — The issues are made public and the CVE records are published.
- Aug 26, 2026 — The announcements reach oss-security. GitHub publishes [GHSA-gcx9-497g-6cp6](https://github.com/advisories/GHSA-gcx9-497g-6cp6) and related advisories rated critical.

## Sources

1. [Apache Tomcat — Apache Tomcat 11.x vulnerabilities (Fixed in 11.0.25)](https://tomcat.apache.org/security-11.html)
2. [Apache Tomcat — Apache Tomcat 10.x vulnerabilities (Fixed in 10.1.59)](https://tomcat.apache.org/security-10.html)
3. [Apache Tomcat — Apache Tomcat 9.x vulnerabilities (Fixed in 9.0.121)](https://tomcat.apache.org/security-9.html)
4. [CVE record — CVE-2026-65182](https://www.cve.org/CVERecord?id=CVE-2026-65182)
5. [CVE record — CVE-2026-68525](https://www.cve.org/CVERecord?id=CVE-2026-68525)
6. [CVE record — CVE-2026-65905](https://www.cve.org/CVERecord?id=CVE-2026-65905)
7. [NVD — CVE-2026-65182](https://nvd.nist.gov/vuln/detail/CVE-2026-65182)
8. [oss-security — CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint](https://www.openwall.com/lists/oss-security/2026/08/26/1)
9. [GitHub Advisory Database — GHSA-gcx9-497g-6cp6](https://github.com/advisories/GHSA-gcx9-497g-6cp6)
10. [Maven Central — spring-boot-dependencies 4.1.1 POM](https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/4.1.1/spring-boot-dependencies-4.1.1.pom)
11. [Spring Boot — Maven plugin: Using the plugin (overriding managed versions)](https://docs.spring.io/spring-boot/maven-plugin/using.html)

---
Source page: https://erroneo.us/security/briefs/apache-tomcat-august-2026-security-constraint-bypasses/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt