Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security

Apache Software Foundation has released Tomcat 11.0.26 to address 12 security vulnerabilities spanning WebSocket, HTTP/2, AJP, authentication, and TLS certificate validation. The flaws, disclosed September 23, 2026, include four rated Important, three Moderate, and five Low, giving administrators a broad but urgent patching task across internet-facing Java application servers. Most existing Tomcat 11 deployments are exposed: many issues affect versions 11.0.0-M1 through 11.0.25, while narrower flaws begin at 11.0.0-M5, 11.0.0-M14, 11.0.19, or 11.0.22. Apache does not provide binary patches for individual vulnerabilities and advises users to install a release containing the fixes, making 11.0.26 the practical remediation...

Read the full article at the source.