CVE-2026-65182 Apache Tomcat: Bypass longest prefix security constraint
Attackers can bypass security constraints in Apache Tomcat when specific path ordering is used, requiring an upgrade to secure the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-65182?
CVE-2026-65182 is a critical missing authorization vulnerability in Apache Tomcat, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
Which versions are affected by CVE-2026-65182?
31 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, tomcat and org.apache.tomcat:tomcat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.1.0-M1 | 10.1.58 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.1.0-M1 | 10.1.58 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M1 | 11.0.25 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 11.0.0-M1 | 11.0.25 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.0 to 7.0.109 | None |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.0 to 7.0.109 | None |
25 more packages
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 to 8.5.100 | None |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 to 8.5.100 | None |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0-M1 | 9.0.121 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0-M1 | 9.0.121 |
tomcat Bitnami | All versions | 9.0.121, 10.1.58, 11.0.25 |
org.apache.tomcat:tomcat Maven | From 10.1.0-M1 | 10.1.58 |
org.apache.tomcat:tomcat Maven | From 10.1.0-M1 | 10.1.58 |
org.apache.tomcat:tomcat Maven | From 11.0.0-M1 | 11.0.25 |
org.apache.tomcat:tomcat Maven | From 11.0.0-M1 | 11.0.25 |
org.apache.tomcat:tomcat Maven | From 7.0.0 to 7.0.109 | None |
org.apache.tomcat:tomcat Maven | From 7.0.0 to 7.0.109 | None |
org.apache.tomcat:tomcat Maven | From 8.5.0 to 8.5.100 | None |
org.apache.tomcat:tomcat Maven | From 8.5.0 to 8.5.100 | None |
org.apache.tomcat:tomcat Maven | From 9.0.0-M1 | 9.0.121 |
org.apache.tomcat:tomcat Maven | From 9.0.0-M1 | 9.0.121 |
org.apache.tomcat:tomcat-catalina Maven | From 10.1.0-M1 | 10.1.58 |
org.apache.tomcat:tomcat-catalina Maven | From 10.1.0-M1 | 10.1.58 |
org.apache.tomcat:tomcat-catalina Maven | From 11.0.0-M1 | 11.0.25 |
org.apache.tomcat:tomcat-catalina Maven | From 11.0.0-M1 | 11.0.25 |
org.apache.tomcat:tomcat-catalina Maven | From 7.0.0 to 7.0.109 | None |
org.apache.tomcat:tomcat-catalina Maven | From 7.0.0 to 7.0.109 | None |
org.apache.tomcat:tomcat-catalina Maven | From 8.5.0 to 8.5.100 | None |
org.apache.tomcat:tomcat-catalina Maven | From 8.5.0 to 8.5.100 | None |
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0-M1 | 9.0.121 |
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0-M1 | 9.0.121 |
Products include Apache Tomcat.
How do I fix CVE-2026-65182?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.1.58, 11.0.25 or 9.0.121.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-65182 being exploited?
There is no known exploitation of CVE-2026-65182 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2026-65182, CLSA-2026-1792688038, DEBIAN-CVE-2026-65182, ECHO-c562-fffb-42f9, GHSA-gcx9-497g-6cp6, MINI-8qwj-528r-648f and 6 more.