Cyber999 Advisories

1.0 Introduction
Recently, Apache has released security updates to address 12 vulnerabilities in Apache Tomcat, including four rated important (CVE-2026-86350, CVE-2026-78383, CVE-2026-77791 & CVE-2026-76183), which impacted multiple supported versions of its open-source application server.

2.0 Impact
Successful exploitation of these vulnerabilities enables denial-of-service (DoS) attacks through WebSocket, HTTP/2 and AJP handling, bypass of security constraints on WebSocket endpoints, HTTP/2 request header mix-up and request smuggling, and weaker certificate checking (OCSP and CRL) and cross-application authentication.

3.0 Affected Product

CVE-2026-86350 – Regression in fix for CVE-2026-41293 can trigger request header mix-up (Important)

• Apache Tomcat 11.0.22 to 11.0.25
• Apache Tomcat 10.1.55 to 10.1.59
• Apache Tomcat 9.0.118 to 9.0.121

CVE-2026-78383 – AJP DoS via missing request body (Important)

• Apache Tomcat 11.0.0-M1 to 11.0.25
• Apache Tomcat 10.1.0-M1 to 10.1.59
• Apache Tomcat 9.0.0.M1 to 9.0.121

CVE-2026-77791 – DoS via busy wait during WebSocket close (Important)

• Apache Tomcat 11.0.0-M5 to 11.0.25
• Apache Tomcat 10.1.8 to 10.1.59
• Apache Tomcat 9.0.74 to 9.0.121

CVE-2026-76183 – Bypass of security constraints for WebSocket endpoints (Important)

• Apache Tomcat 11.0.0-M1 to 11.0.25
• Apache Tomcat 10.1.0-M1 to 10.1.59
• Apache Tomcat 9.0.0.M1 to 9.0.121

CVE-2026-86248 – OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (Moderate)

• Apache Tomcat 11.0.0-M14 to 11.0.25
• Apache Tomcat 10.1.22 to 10.1.59
• Apache Tomcat 9.0.92 to 9.0.121

CVE-2026-79677 – WebSocket DoS due to lost asynchronous write timeout (Moderate)

• Apache Tomcat 11.0.0-M1 to 11.0.25
• Apache Tomcat 10.1.0-M1 to 10.1.59
• Apache Tomcat 9.0.0.M1 to 9.0.121

CVE-2026-73581 – OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when the certificate uses a keystore (Moderate)

• Apache Tomcat 11.0.0-M1 to 11.0.25
• Apache Tomcat 10.1.0-M1 to 10.1.59
• Apache Tomcat 9.0.0.M1 to 9.0.121

CVE-2026-87022 – WebSocket message smuggling with per-message-deflate (Low)

• Apache Tomcat 11.0.0-M1 to 11.0.25
• Apache Tomcat 10.1.0-M1 to 10.1.59
• Apache Tomcat 9.0.0.M1 to 9.0.121

CVE-2026-78437 – HTTP/2 DoS via malformed request (Low)

• Apache Tomcat 11.0.19 to 11.0.25
• Apache Tomcat 10.1.53 to 10.1.59
• Apache Tomcat 9.0.116 to 9.0.121

CVE-2026-77762 – Stale HPACK emitter injects trailers into recycled pooled request (Low)

• Apache Tomcat 11.0.0-M1 to 11.0.25
• Apache Tomcat 10.1.0-M1 to 10.1.59
• Apache Tomcat 9.0.39 to 9.0.121

CVE-2026-77756 – Transfer-Encoding honoured for HTTP/1.0 requests (Low)

• Apache Tomcat 11.0.0-M1 to 11.0.25
• Apache Tomcat 10.1.0-M1 to 10.1.59
• Apache Tomcat 9.0.47 to 9.0.121

CVE-2026-75973 – Cross-context authentication mix-up with Jakarta Authentication configured (Low)

• Apache Tomcat 11.0.0-M1 to 11.0.25
• Apache Tomcat 10.1.0-M1 to 10.1.59
• Apache Tomcat 9.0.0.M4 to 9.0.121

4.0 Recommendations
CyberSecurity Malaysia urges users and organisations to review the Apache Tomcat Security Bulletin, follow the Mitigation steps and apply the necessary updates. Administrators should also confirm the running version after the update and prioritise internet-facing servers that use WebSocket, HTTP/2 or AJP connectors.

Fixed Versions:

• Apache Tomcat 11.0.26
• Apache Tomcat 10.1.60
• Apache Tomcat 9.0.122

Kindly refer to the URL for more information:

• https://tomcat.apache.org/security-11.html
• https://tomcat.apache.org/security-10.html
• https://tomcat.apache.org/security-9.html

Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact Cyber999 Incident Response Centre through the following channels:

E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my

5.0 References

• https://tomcat.apache.org/security.html
• https://tomcat.apache.org/security-9.html
• https://tomcat.apache.org/security-10.html
• https://tomcat.apache.org/security-11.html