CVE-2026-86350 Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...

EUVD-2026-85234

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...

CVE-2026-86248

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...

CVE-2026-86248 Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...

CVE-2026-86248

Apache Tomcat is vulnerable to a flaw where CLIENT_CERT authentication does not fail as expected in specific scenarios even when soft fail is disabled. This was caused by an incomplete fix for CVE-2026-34500 , where OCSP checks sometimes soft-fail with FFM. This issue affects versions 11.0.0-M14 ...

CVE-2026-79677 Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through...

CVE-2026-79677

A concurrency bug in Apache Tomcat allows an attacker to trigger a denial of service (DoS) by causing lost timeouts during asynchronous WebSocket writes . This vulnerability affects the following versions: 11.0.0-M1 through 11.0.25 , 10.1.0-M1 through 10.1.59 , and 9.0.0.M1 through 9.0.121 . Addi...

CVE-2026-79677

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through...

EUVD-2026-85232

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through...

CVE-2026-79677 Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through...

CVE-2026-78437

A malformed HTTP/2 request can trigger a denial of service (DoS) in Apache Tomcat due to an incomplete cleanup vulnerability. Depending on the timing, this flaw may cause one user's request to fail. Affected versions include 11.0.19 through 11.0.25 , 10.1.53 through 10.1.59 , and 9.0.116 through ...

EUVD-2026-85231

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially depends on timing cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are...

CVE-2026-78437

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially depends on timing cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are...

CVE-2026-78437 Apache Tomcat: HTTP/2 DoS via malformed request

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially depends on timing cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are...

CVE-2026-78383

Apache Tomcat is vulnerable to a denial of service (DoS) attack due to a resource allocation flaw where requests without a body can pin an AJP processing thread . This issue impacts versions 11.0.0-M1 through 11.0.25 , 10.1.0-M1 through 10.1.59 , and 9.0.0.M1 through 9.0.121 . Older End-of-Life v...

EUVD-2026-85230

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1...

CVE-2026-78383

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1...

CVE-2026-78383 Apache Tomcat: AJP DoS via missing request body

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1...

CVE-2026-77791 Apache Tomcat: DoS via busy wait during WebSocket close

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...

EUVD-2026-85229

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...