https://seclists.org/oss-sec/2026/q3/900: CVE-2026-76183: Apache Tomcat: Bypass of security constraints for WebSocket endpoints

Q: How can I determine whether an Apache Tomcat deployment is potentially affected?

Check the deployed Tomcat version against the listed affected ranges: 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, 8.5.0 through 8.5.100, and 7.0.43 through 7.0.109. The advisory also lists Tomcat versions before 7.0.43.

Q: Which Tomcat release families require review?

The affected-version list includes the 11.0.x, 10.1.x, 9.0.x, 8.5.x, and 7.0.x Tomcat families, including milestone releases at the beginning of several branches.

Published Sep 23, 2026

Updated

Affected Software

1 affected component

Apache Tomcat>=11.0.0-M1<=11.0.25, >=10.1.0-M1<=10.1.59, >=9.0.0.M1<=9.0.121, >=8.5.0<=8.5.100, >=7.0.43<=7.0.109, <7.0.43

Frequently Asked Questions

How can I determine whether an Apache Tomcat deployment is potentially affected?

Check the deployed Tomcat version against the listed affected ranges: 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, 8.5.0 through 8.5.100, and 7.0.43 through 7.0.109. The advisory also lists Tomcat versions before 7.0.43.

Which Tomcat release families require review?

The affected-version list includes the 11.0.x, 10.1.x, 9.0.x, 8.5.x, and 7.0.x Tomcat families, including milestone releases at the beginning of several branches.

https://seclists.org/oss-sec/2026/q3/900: CVE-2026-76183: Apache Tomcat: Bypass of security constraints for WebSocket endpoints

Affected Software

Frequently Asked Questions

How can I determine whether an Apache Tomcat deployment is potentially affected?

Which Tomcat release families require review?

Company

Resources

Contact

Frequently Asked Questions

How can I determine whether an Apache Tomcat deployment is potentially affected?

Which Tomcat release families require review?