CVE-2026-86350

Improper handling of length parameter inconsistency in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. Affects versions from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121; also known affected: 8.5.0-8.5.100 and 7.0.56-7.0.109.

A vulnerability in Apache Tomcat causes lost timeouts for asynchronous WebSocket writes, leading to denial of service (DoS). The issue affects many Tomcat versions, including 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121.

A vulnerability in Apache Tomcat related to incomplete cleanup can cause a malformed request to potentially (depending on timing) cause one request from another user to fail. Affects versions 11.0.19-11.0.25, 10.1.53-10.1.59, and 9.0.116-9.0.121.

A vulnerability in Apache Tomcat involving uncontrolled resource allocation allows an unauthenticated AJP request to pin an AJP processing thread, leading to denial of service. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.0.M1-9.0.121.

A vulnerability in Apache Tomcat involving uncontrolled resource consumption during sending of WebSocket close message enables a DoS attack. Affects versions 11.0.0-M5-11.0.25, 10.1.8-10.1.59, and 9.0.74-9.0.121.

A vulnerability in Apache Tomcat involving a race condition allows an attacker to inject trailer fields into another HTTP/2 request. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.39-9.0.121.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy. Affects versions: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121. Known affected EOL versions: 8.5.67 through 8.5.100. Recommended upgrade to 11.0.26, 10.1.60 or 9.0.122.

A vulnerability in Apache Tomcat related to improper authentication. When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications use that provider, the realm for the first web application to authenticate a request will be used for all web applications. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.0.M4-9.0.121.

Apache Tomcat has a vulnerability in certificate revocation checking. OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when a certificate uses a keystore. Affects versions 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.58, 9.0.0-M1 through 9.0.121, and 8.5.0 through 8.5.100.

The vulnerability related to improper handling of case sensitivity in LockOutRealm in Apache Tomcat may lead to unauthorized access. It affects versions from 11.0.0-M1 to 11.0.21, from 10.1.0-M1 to 10.1.54, from 9.0.0.M1 to 9.0.117, from 8.5.0 to 8.5.100, and from 7.0.0 to 7.0.109.