Ten Apache Tomcat Vulnerabilities: Authentication, Paths and Denial of Service

Ten configuration-dependent CVEs

Apache published ten Tomcat CVEs spanning authentication, declarative security constraints, RewriteValve, HTTP/2, WebSocket examples and Unix Domain Sockets. Fixed active-branch releases are 11.0.25, 10.1.59 and 9.0.121. Tomcat 10.1.58 did not pass the release vote and should not be treated as the fixed build.

Authentication and authorization

CVE-2026-68569 affects CLIENT-CERT or SPNEGO with DataSourceRealm or JDBCRealm when a principal lookup fails open. CVE-2026-68525 concerns method-specific FORM constraints, and CVE-2026-66422 concerns security-role-ref aliases. Test absent users, saved requests, HTTP methods and role mappings with controlled accounts.

Paths and rewrite rules

CVE-2026-65182 affects overlapping path constraints. CVE-2026-65927 makes RewriteValve [N] restart from the second rule, which can bypass security logic. Compare application paths, proxy rewrites, context roots and rule order, then retest protected subpaths after upgrade.

Resource and local boundaries

CVE-2026-68763 concerns HTTP/2 resource leakage, CVE-2026-66299 affects the deployed WebSocket chat example, CVE-2026-65183 is a UDS race, CVE-2026-65637 covers strict SNI without authority, and CVE-2026-65905 concerns one DIGEST replay. Inventory each feature rather than applying one generic severity label.

Upgrade and verify

Back up connector, Realm, rewrite and deployment configuration. Follow the vendor path for bundled Tomcat distributions, update every rolling node and prevent old images from returning through autoscaling. Validate authentication, roles, paths, rewrites, WebSocket, HTTP/2, UDS and normal application behavior.