CVE-2026-87022
HighCVSS 7.5Summary
Improper handling of length parameter inconsistency in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. Affects versions from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121; also known affected: 8.5.0-8.5.100 and 7.0.56-7.0.109.
Risk Assessment
An attacker can smuggle WebSocket messages, potentially leading to communication integrity compromise or unauthorized actions.
Recommendation
Upgrade Apache Tomcat to version 11.0.26, 10.1.60, or 9.1.22, which fix the issue.
Other vulnerabilities in Apache Tomcat
See all- CVE-2026-79677High
A vulnerability in Apache Tomcat causes lost timeouts for asynchronous WebSocket writes, leading to denial of service (DoS). The issue affects many Tomcat versions, including 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121.
- CVE-2026-78437High
A vulnerability in Apache Tomcat related to incomplete cleanup can cause a malformed request to potentially (depending on timing) cause one request from another user to fail. Affects versions 11.0.19-11.0.25, 10.1.53-10.1.59, and 9.0.116-9.0.121.
- CVE-2026-78383High
A vulnerability in Apache Tomcat involving uncontrolled resource allocation allows an unauthenticated AJP request to pin an AJP processing thread, leading to denial of service. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.0.M1-9.0.121.
- CVE-2026-77791High
A vulnerability in Apache Tomcat involving uncontrolled resource consumption during sending of WebSocket close message enables a DoS attack. Affects versions 11.0.0-M5-11.0.25, 10.1.8-10.1.59, and 9.0.74-9.0.121.
- CVE-2026-77762High
A vulnerability in Apache Tomcat involving a race condition allows an attacker to inject trailer fields into another HTTP/2 request. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.39-9.0.121.
- CVE-2026-77756Low
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy. Affects versions: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121. Known affected EOL versions: 8.5.67 through 8.5.100. Recommended upgrade to 11.0.26, 10.1.60 or 9.0.122.
- CVE-2026-75973High
A vulnerability in Apache Tomcat related to improper authentication. When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications use that provider, the realm for the first web application to authenticate a request will be used for all web applications. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.0.M4-9.0.121.
- CVE-2026-73581Medium
Apache Tomcat has a vulnerability in certificate revocation checking. OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when a certificate uses a keystore. Affects versions 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.58, 9.0.0-M1 through 9.0.121, and 8.5.0 through 8.5.100.
- CVE-2026-43513High
The vulnerability related to improper handling of case sensitivity in LockOutRealm in Apache Tomcat may lead to unauthorized access. It affects versions from 11.0.0-M1 to 11.0.21, from 10.1.0-M1 to 10.1.54, from 9.0.0.M1 to 9.0.117, from 8.5.0 to 8.5.100, and from 7.0.0 to 7.0.109.
- CVE-2026-42498High
A vulnerability in Apache Tomcat related to the exposure of the HTTP Authentication Header to unexpected hosts during WebSocket authentication. It affects versions from 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.2 to 9.0.117, 8.5.24 to 8.5.100, and 7.0.83 to 7.0.109.
Original NVD description (English source)
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue.