Apache Tomcat 11.0.26 Patches Dozens of Vulnerabilities Including WebSocket Bypass Flaw

Apache Software Foundation announced the release of Tomcat 11.0.26, a maintenance update that resolves twelve security weaknesses identified in the popular Java servlet container. Among the fixes is a critical vulnerability that could let an attacker circumvent security constraints designed to protect WebSocket endpoints, raising concerns for applications that rely on real‑time communication.

Tomcat, widely deployed in enterprise and cloud environments to serve Java web applications, has long been a cornerstone of the Java ecosystem. The newly patched flaws span several categories, notably denial‑of‑service (DoS) conditions that could be triggered by crafted HTTP requests, potentially exhausting server resources and disrupting service availability.

The WebSocket bypass issue stems from insufficient validation of request attributes before the server hands control over to the WebSocket implementation. In practice, a malicious client could craft a request that evades the usual security checks, gaining access to protected channels and possibly injecting malicious payloads. While the exact CVE identifiers were not disclosed in the initial report by GBHackers, the advisory emphasizes that the vulnerability is “significant” and warrants immediate attention.

DoS vectors addressed in this update include scenarios where malformed headers or oversized payloads could cause the connector threads to hang or the server to consume excessive memory. Such weaknesses have historically been exploited in large‑scale attacks that aim to overwhelm public‑facing services, making the remediation especially relevant for high‑traffic sites.

Administrators are urged to upgrade to Tomcat 11.0.26 without delay. The upgrade process is straightforward for most deployments, as the new version retains binary compatibility with earlier 11.x releases. The Apache foundation also recommends reviewing configuration settings for WebSocket endpoints and applying additional hardening measures, such as restricting origin headers and enabling TLS encryption.

Security researchers note that the rapid patch cycle reflects Apache’s commitment to addressing vulnerabilities promptly, but they also caution that organizations should maintain a regular patching cadence. As the Java platform continues to evolve, staying current with Tomcat updates remains a key defense against emerging threats. The community will likely monitor the situation for any follow‑up disclosures, while users of earlier Tomcat versions, including the long‑standing 9.x and 10.x branches, should verify whether back‑ported fixes are available for their environments.