CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.25 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.58 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.121
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments are exposed when their security constraints define a longer path before a more restrictive constraint for a shorter sub-path. The issue affects the listed Tomcat release ranges through 11.0.24, 10.1.57, 9.0.120, 8.5.100, and 7.0.109.
What configuration condition does an attacker rely on?
An attacker relies on the ordering of security constraints: a constraint for a longer path must be specified before a more restrictive constraint for a shorter sub-path. The provided information does not indicate that all default Tomcat configurations meet this condition.
What versions remediate the issue?
Upgrade to Apache Tomcat 11.0.25, 10.1.58, or 9.0.121. These versions are identified as fixing the issue.