Apache Tomcat 9.0.121 Fixes 11 CVEs, 8 Affect EOL Tomcat 8.5

On August 25, 2026, the Apache Tomcat security team disclosed ten new CVEs, all fixed in Tomcat 9.0.121, released August 18. An eleventh, CVE-2026-66299, went public on July 28 and is fixed in the same release. Four are rated Important by Apache: a security constraint bypass (CVE-2026-65182), a rewrite valve access-control bypass (CVE-2026-65927), authentication that fails open against DataSourceRealm and JDBCRealm (CVE-2026-68569), and an HTTP/2 allocation-leak denial of service (CVE-2026-68763). NVD has not yet assigned CVSS scores to any of them, so the Apache severity ratings are the authoritative signal for now.

Eight of the eleven are confirmed by Apache's published CVE records to also affect Tomcat 8.5, which reached end of life on March 31, 2024 at version 8.5.100. There is no OSS fix available for the 8.5 branch, and there never will be. HeroDevs NES for Apache Tomcat exists for exactly this gap.

Affected and unsupported? See NES for Apache Tomcat.

‍

The eleven CVEs fixed in Tomcat 9.0.121

Here is the full set, with Apache's own severity ratings and the confirmed Tomcat 8.5 status from each published CVE record.

‍

CVE-2026-65182 | Important | Security constraint bypass

Tomcat's security constraint processing (CWE-284, CWE-863) allowed a bypass when a constraint for a longer path was specified before a more restrictive constraint for a shorter sub-path. In practice, the ordering of security-constraint elements in web.xml could silently defeat the more restrictive rule, exposing resources the application intended to protect. Affects Tomcat 9.0.0.M1 through 9.0.120, plus the 11.0.x, 10.1.x, 8.5.x, and 7.0.x lines. Confirmed affecting Tomcat 8.5.0 through 8.5.100.

‍

CVE-2026-65927 | Important | Rewrite valve access-control bypass

An off-by-one error (CWE-193) in the [N] flag on the rewrite valves caused rewrite processing to restart at the second rule rather than the first. If your first rewrite rule enforces an access-control decision, a rewritten request can skip it entirely. Rewrite valve bugs are a recurring theme in Tomcat: CVE-2026-59083, CVE-2026-53404, and CVE-2025-55752 all lived in the same component. Confirmed affecting Tomcat 8.5.0 through 8.5.100.

‍

CVE-2026-68569 | Important | Principal lookup fails open

For some authentication methods, such as CLIENT-CERT and SPNEGO, Tomcat would authenticate a user even if that user did not exist in the DataSourceRealm or JDBCRealm (CWE-287). Authentication that fails open is the worst direction to fail: the realm lookup misses, and the request proceeds as authenticated anyway. Confirmed affecting Tomcat 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109.

‍

CVE-2026-68763 | Important | HTTP/2 allocation-leak denial of service

An allocation leak in HTTP/2 backlog tracking when a stream is reset (CWE-400) could be manipulated by a remote client to exhaust memory and take the server down. Affects Tomcat 9.0.39 through 9.0.120 and, confirmed by the CVE record, Tomcat 8.5.59 through 8.5.100. HTTP/2 resource-exhaustion bugs have hit Tomcat repeatedly since 8.5 went EOL, including CVE-2025-53506 and CVE-2025-31650, neither of which 8.5 ever received a fix for.

‍

CVE-2026-65637 | Moderate | HTTP/2 bypass of strict SNI validation

The fix for CVE-2026-32990 was incomplete (CWE-20): an HTTP/2 request with no authority could bypass strict SNI validation. Affects Tomcat 9.0.115 through 9.0.120 only, since the strict SNI validation it bypasses is itself recent. Apache has not assessed Tomcat 8.5 for this one. Not assessed is not the same as not affected; nobody has checked, and nobody will.

‍

CVE-2026-65905 | Low | DIGEST authentication replay

A client that made a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window, before windowSize requests had been made, produced a request that was replayable once (CWE-294). A narrow window, but a real one: an attacker who can capture traffic can replay an authenticated request. Confirmed affecting Tomcat 8.5.0 through 8.5.100 and 7.0.30 through 7.0.109.

‍

CVE-2026-66422 | Low | Servlet role references bypass declarative role constraints

security-role-ref definitions were incorrectly used as role aliases within the Realm, in addition to their correct use with Request.isUserInRole() (CWE-285). A role reference intended as a local alias for one servlet could grant access against constraints defined for the real role. Confirmed affecting Tomcat 8.5.46 through 8.5.100.

‍

CVE-2026-68525 | Low | FORM authentication redirect bypasses method-specific constraints

The redirect issued after FORM authentication allowed bypassing a security constraint that limited a user's access to a resource via POST but not GET (CWE-863). Method-specific constraints are common in apps that expose read-only GET endpoints while restricting writes. Confirmed affecting Tomcat 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109.

‍

CVE-2026-73180 | Low | Authenticated WebSocket session survives end of HTTP session

If the session ID of an authenticated HTTP session changed after a WebSocket connection was established under it, the WebSocket session was not closed when the HTTP session ended, as the Jakarta WebSocket specification requires (CWE-613). Logout stops meaning logout for any open WebSocket. Confirmed affecting Tomcat 8.5.0 through 8.5.100 and 7.0.43 through 7.0.109.

‍

CVE-2026-65183 | Low | TOCTOU race on Unix Domain Socket permissions

A race condition when creating a Unix Domain Socket (CWE-367) allowed an unauthorized local user to access the socket before restrictive permissions were applied. Tomcat 8.5 is genuinely not affected: Unix Domain Socket support arrived in 9.0.42, and 8.5 has no UDS connector at all.

‍

CVE-2026-66299 | Low | Denial of service in the WebSocket chat example

The WebSocket chat example shipped an unbounded buffer for undelivered messages (CWE-400). A maliciously slow client could grow the buffer until the Tomcat process ran out of memory. Apache rates this Low; CISA's ADP program scored it 7.5 High, worth knowing if it lights up your scanner. This is the one CVE in the batch that went public early, on July 28. If you have followed the long-standing guidance to remove the examples web application from production, you were never exposed. Tomcat 8.5 is not affected: the vulnerable example code was introduced in 9.0.89.

‍

Exploitation status

None of the eleven CVEs appear in the CISA Known Exploited Vulnerabilities catalog as of August 25, 2026, and Apache's advisories report no active exploitation. Ten of the eleven are hours old, so treat that as a snapshot, not a verdict.

The 8.5 back-catalog is a different story. CVE-2025-24813, the partial PUT path equivalence bug that NVD scores 9.8 Critical, is in the KEV catalog with confirmed active exploitation. It affects Tomcat 8.5.0 through 8.5.100, and the 8.5 branch never received a fix.

‍

The pattern: six of eleven are access-control failures

Look at what this batch actually breaks: security constraint ordering (CVE-2026-65182), rewrite-based access control (CVE-2026-65927), realm authentication failing open (CVE-2026-68569), role reference aliasing (CVE-2026-66422), method-specific constraints after FORM login (CVE-2026-68525), and DIGEST replay (CVE-2026-65905). Six of the eleven are ways for a request to reach something it should not, or for a user to become someone they are not.

That concentration matters for anyone still on 8.5, because it continues a pattern across the whole post-EOL window: CVE-2026-43512 (the Digest authenticator would authenticate any unknown user), CVE-2025-66614 (client certificate verification bypass via virtual host mapping), CVE-2026-55957 (JNDIRealm GSSAPI authentication bypass), and CVE-2026-43515 (security constraints not correctly applied) all hit 8.5, and none were ever fixed there. Layered access-control defects compound: each unpatched bypass makes the next one cheaper to chain.

‍

The bigger picture: 877 days, 48 unpatched CVEs on Tomcat 8.5

Tomcat 8.5 reached end of life on March 31, 2024. Its final release was 8.5.100, and Apache states plainly that vulnerabilities reported after that date will not be fixed. Here is what has accumulated since, sourced from the published CVE records rather than the frozen 8.x security page:

Three of the 48 carry an NVD primary score of 9.0 or higher: CVE-2025-24813 (9.8, remote code execution via partial PUT), CVE-2025-31651 (9.8, rewrite rule bypass), and CVE-2025-66614 (9.1, client certificate verification bypass). Both default-servlet RCEs (CVE-2024-50379 and CVE-2024-56337) are rated Important by Apache and 9.8 by CISA's ADP enrichment.

One divergence worth pausing on: CVE-2025-31651 is rated Low by Apache and 9.8 Critical by NVD's own analysts. Apache scores against a default configuration; NVD scores the worst case. For an 8.5 operator the disagreement is academic, because there is no patch either way.

And note what an audit based on Apache's 8.x security page alone would miss. That page stops at 70 CVEs and February 2024, by design. It will never list any of the 48. If your compliance evidence for Tomcat 8.5 is "the vendor security page shows nothing new," your evidence is measuring the wrong thing.

To be fair to the other direction: five post-EOL CVEs are confirmed not to touch 8.5, including CVE-2026-66299 and CVE-2026-65183 from this batch, mostly because the vulnerable code (Unix Domain Sockets, the FFM connector, newer example apps) postdates 8.5 entirely. The confirmed-affected list above does not inflate those in.

‍

Who is affected, and what to do

The affected versions across currently supported and EOL branches:

If you are on Tomcat 9.0, 10.1, or 11.0

Upgrade. The fixes are in Tomcat 9.0.121, 10.1.58, and 11.0.25. While you are at it, confirm the examples web application is removed from every production instance; CVE-2026-66299 is the second examples-app DoS in two years, after CVE-2024-54677.

If you are on Tomcat 8.5 or earlier

You have three real options, and "wait for a patch" is not one of them.

‍

Mitigation guidance

Defense-in-depth reduces exposure to specific bugs in this batch. It does not address the other 40-plus unpatched 8.5 CVEs, including the actively exploited CVE-2025-24813.

‍

Related CVEs

The eleven CVEs above join a long post-EOL tail for Tomcat 8.5. Ones worth reviewing if 8.5 is still in your fleet: CVE-2025-24813 (RCE, in CISA KEV), CVE-2024-50379 and CVE-2024-56337 (default servlet RCEs), CVE-2025-31651 (rewrite rule bypass), CVE-2026-43512 (Digest authenticator accepts unknown users), CVE-2025-66614 (client cert bypass), and CVE-2025-55752 (rewrite valve path traversal).

For the previous batches, see our June 2026 Tomcat round-up and the May 2026 security release. If you run Spring Boot 2.7 on embedded Tomcat, two earlier Tomcat CVEs also affect that stack.

‍

Frequently asked questions

Will Apache release a Tomcat 8.5 fix for any of these? No. Apache's policy is explicit: 8.5 reached end of life on March 31, 2024, and vulnerabilities reported after that date will not be assessed or fixed on that branch.

Why don't these CVEs have CVSS scores? NVD had not analyzed ten of the eleven at disclosure time, and the Apache Tomcat security team does not publish CVSS scores at all; it publishes a textual rating (Low, Moderate, Important, Critical). Any number your scanner shows for these this week is an enricher's estimate, not an NVD analysis. CVE-2026-66299 is the exception, carrying a 7.5 High score from CISA's ADP program.

Is my Tomcat 8.5 safe if it is internal-only? Safer, not safe. Six of the eight 8.5-affecting CVEs in this batch are authentication or authorization weaknesses, which matter on internal networks too, particularly against lateral movement. And internal-only rarely survives contact with an architecture diagram.

Does this affect Spring Boot? Spring Boot 2.x embeds Tomcat 9.0.x, so Spring Boot apps on maintained Tomcat 9 builds get these fixes by bumping the embedded Tomcat to 9.0.121. Spring Boot 2.7 itself is EOL, which creates its own version pinning problems; we covered that intersection here.

What about the CVEs marked "not assessed" for 8.5? Treat them as open questions. Apache stopped assessing 8.5 in March 2024, so a missing 8.5 entry in a CVE record means nobody checked, not that 8.5 is clear. Eleven post-EOL CVEs sit in that state today, including CVE-2026-65637 from this batch.

‍

Taking action

Tomcat 9.0.121 closes all eleven CVEs for supported branches, and upgrading is the right move if you are on 9.0.x, 10.1.x, or 11.0.x. But if you are one of the many teams still running Tomcat 8.5, this release is the 877th day of accumulating exposure: 48 confirmed unpatched CVEs and counting, with four more Important-rated issues added today.

NES for Apache Tomcat gives you a drop-in replacement for the EOL 8.5 branch that resolves these vulnerabilities as they land, without forcing a migration on someone else's timeline. Migrate when your roadmap says so, not when a CVE does. Talk to us about coverage for your Tomcat fleet.