|
ELS
< Back

CVE-2026-65182

Updated on 25 Aug 2026

Severity

9.1 Critical severity

Details

CVSS score
9.1
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.

Details

Affected product:
AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , Apache CXF , Apache Log4j , Apache Tapestry , Apache Tomcat , CentOS 7 ELS , Debian 10 ELS , Debian 11 ELS , Spring , TuxCare 9.6 ESU , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS , camel , flume , grails-core , logging-flume , pulsar , thrift
Affected packages:
Spring Boot @ 2.6.15 (+4262 more)

Fixes