📋 ADVISORIES
- Apache Tomcat 11.0.26 Fixes 12 Vulnerabilities in WebSocket, HTTP/2, AJP, Auth, and TLS
Apache has released Tomcat 11.0.26 fixing 12 security vulnerabilities across WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation.- Applies to Apache Tomcat 11 deployments, especially internet-facing Java application servers; most issues affect versions 11.0.0-M1 through 11.0.25, with narrower flaws starting at 11.0.0-M5, 11.0.0-M14, 11.0.19, or 11.0.22.
- 12 flaws disclosed September 23, 2026: four rated Important, three Moderate, five Low, spanning WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation.
- Key flaws include CVE-2026-87022 (WebSocket message smuggling via per-message-deflate length handling), CVE-2026-86350 (HTTP/2 request-header mix-up regression in 11.0.22-11.0.25), and CVE-2026-76183 (Important WebSocket authorization bypass).
- Denial-of-service bugs include CVE-2026-78383 (AJP thread pinning), CVE-2026-77791 (busy-wait on WebSocket close), and CVE-2026-79677 (lost async write timeouts); TLS fixes cover CVE-2026-86248 and CVE-2026-73581 (ignored certificate revocation lists).
- Several bugs involve races and shared connection state, so exploitation may be intermittent; Apache provides no per-vulnerability binary patches, making 11.0.26 the practical remediation baseline.
Sources 📄 Source: tomcat.apache.org · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
📋 ADVISORIES
- 📄 Source for D-Link DIR-825 rp-l2tp tunnel_set_params flaw CVE-2026-96891 allows remote out-of-bounds write — vuldb.com
🔓 CVEs & KEV
CVE-2026-97055 — signoz — CVSS 9.2 — SigNoz before 0.143.0 Authentication Bypass via Empty JWT SecretSigNoz from v...
CVE-2026-97056 — signoz — CVSS 7.6 — SigNoz before 0.143.0 Insufficient Session Expiration Authentication BypassSi...