Tomcat security constraint bypass fixed as CVE-2026-65182
Path ordering could let requests slip past more restrictive access rules on shorter prefixes.
Apache Tomcat has patched an important access-control flaw, tracked as CVE-2026-65182, in which the order of security constraints could allow a bypass of intended authorization rules.
The bug is improper access control: if a constraint for a longer path was declared before a more restrictive constraint on a shorter sub-path, Tomcat could apply the wrong rule. Applications that layered URL security constraints by path length were at risk of exposing protected resources to unauthorized clients.
The issue spans a long line of releases: Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. Maintainers recommend upgrading to 11.0.25, 10.1.58, or 9.0.121.
Mark Thomas of the Tomcat project published the advisory. Credit for finding the issue goes to 4ra1n, pyn3rd, and unam4.