CVE-2026-65182
Apache Tomcat: security constraint bypass with overlapping path constraints
Technology
Apache Tomcat
CVSS Score
9.1 / 10.0
Affected Versions
11.0.0-M1 to 11.0.24; 10.1.0-M1 to 10.1.57; 9.0.0.M1 to 9.0.120; 8.5.0 to 8.5.100; 7.0.0 to 7.0.109
Upstream Fix
11.0.25; 10.1.59; 9.0.121
Published
August 25, 2026
OSSeva Coverage
Fixed upstream
Description
If a security constraint for a longer path was declared before a more restrictive constraint for a shorter sub-path, Tomcat's constraint processing allowed the more restrictive constraint to be bypassed. Made public on 25 August 2026 and rated Important by the Tomcat security team. Fixed in 11.0.25, 10.1.59 and 9.0.121; the 10.1.58 release vote did not pass, so 10.1.59 is the first 10.1 release with the fix.
Is your Apache Tomcat deployment affected?
If you're running 11.0.0-M1 to 11.0.24; 10.1.0-M1 to 10.1.57; 9.0.0.M1 to 9.0.120; 8.5.0 to 8.5.100; 7.0.0 to 7.0.109, you need this patch. Book a discovery call to get covered.
Get a quote
Running Apache Tomcat 11.0.0-M1 to 11.0.24; 10.1.0-M1 to 10.1.57; 9.0.0.M1 to 9.0.120; 8.5.0 to 8.5.100; 7.0.0 to 7.0.109?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?