Apache Tomcat releases update to fix WebSocket and HTTP/2 security flaws

The Apache Software Foundation has released Apache Tomcat 11.0.26 to address multiple security vulnerabilities. The updates target a range of flaws affecting WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation.

Key vulnerabilities include CVE-2026-87022, a WebSocket message smuggling flaw related to improper handling of length parameters during per-message-deflate compression, and CVE-2026-86350, an HTTP/2 regression that can cause request-header mix-ups. Other identified issues include several denial-of-service (DoS) risks involving AJP processing, WebSocket close messages, and malformed HTTP/2 requests.

Administrators are advised to upgrade to version 11.0.26, as the foundation does not provide binary patches for individual vulnerabilities. Many existing deployments of Tomcat 11 are currently exposed to these risks.