THE Apache Software Foundation has released Tomcat 11.0.26 to address 15 security vulnerabilities. The supplied report lists 12 CVEs, including three rated Critical, seven High, one Medium and one Low; the highest listed score is 9.8 for CVE-2026-86248. No active exploitation has been confirmed. The issues affect Tomcat versions 11.0.0-M1 through 11.0.25, while CVE-2026-78437 specifically affects versions 11.0.19 to 11.0.25.
The flaws affect HTTP/2 processing, WebSockets and AJP connectors. CVE-2026-86350 can cause inconsistent interpretation of HTTP/2 requests and request-header mix-ups. CVE-2026-78383 can pin an AJP processing thread when a request body is omitted, resulting in denial of service. CVE-2026-87022 concerns WebSocket message smuggling when per-message-deflate is enabled, while CVE-2026-77791 can cause a busy wait when sending a WebSocket close message. A race condition in CVE-2026-77762 may inject trailer fields into recycled pooled HTTP/2 requests through a stale HPACK emitter.
Administrators are advised to upgrade to Tomcat 11.0.26. The report also recommends that perimeter defences drop malformed HTTP/1.0 requests containing `Transfer-Encoding` headers to reduce residual risk.