https://seclists.org/oss-sec/2026/q3/900: CVE-2026-76183: Apache Tomcat: Bypass of security constraints for WebSocket endpoints
Published Sep 23, 2026
·Updated
Affected Software
1 affected component
Apache Tomcat>=11.0.0-M1<=11.0.25, >=10.1.0-M1<=10.1.59, >=9.0.0.M1<=9.0.121, >=8.5.0<=8.5.100, >=7.0.43<=7.0.109, <7.0.43
Frequently Asked Questions
1
How can I determine whether an Apache Tomcat deployment is potentially affected?
Check the deployed Tomcat version against the listed affected ranges: 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, 8.5.0 through 8.5.100, and 7.0.43 through 7.0.109. The advisory also lists Tomcat versions before 7.0.43.
2
Which Tomcat release families require review?
The affected-version list includes the 11.0.x, 10.1.x, 9.0.x, 8.5.x, and 7.0.x Tomcat families, including milestone releases at the beginning of several branches.