# CVE-2026-65182: Apache Tomcat security constraint bypass

Source: https://junglewise.ai/threats/cve-2026-65182-apache-tomcat-security-constraint-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-65182 · Severity: critical · CVSS 9.1 · Published 2026-08-25

Apache Tomcat is a widely-used application server that enforces URL-based security restrictions to control access to sensitive web resources. A flaw in how these restrictions are processed allows an attacker to bypass security controls if a constraint protecting a longer URL path is defined before a more specific constraint protecting a shorter sub-path. This could permit unauthorized access to protected resources, exposing sensitive data or functionality to remote attackers without authentication.

Technologies: [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat), [org.apache.tomcat:tomcat (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat), [org.apache.tomcat:tomcat-catalina (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina), [org.apache.tomcat.embed:tomcat-embed-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-65182 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65182 being exploited in the wild.

**How severe is CVE-2026-65182?** Critical severity, with a CVSS score of 9.1, published 25 August 2026.

**Which products and versions are affected?** Apache Tomcat 7.0.0-7.0.109; org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.25; org.apache.tomcat:tomcat-catalina (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.25; org.apache.tomcat.embed:tomcat-embed-core (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.25.

**Is there a fix for CVE-2026-65182?** Yes. org.apache.tomcat:tomcat (Maven): upgrade to 11.0.25 or later; org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.25 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65182 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-65182?** Check whether you run Apache Tomcat, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.tomcat:tomcat (Maven): upgrade to 11.0.25 or later

  ```sh
  # set org.apache.tomcat:tomcat to 11.0.25 in your pom.xml or build.gradle
  ```

- org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.25 or later

  ```sh
  # set org.apache.tomcat:tomcat-catalina to 11.0.25 in your pom.xml or build.gradle
  ```

- org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.25 or later

  ```sh
  # set org.apache.tomcat.embed:tomcat-embed-core to 11.0.25 in your pom.xml or build.gradle
  ```


## Technical details

This vulnerability is an improper access control issue (CWE-284) in Tomcat's security constraint matching logic. When security constraints are configured, a longer path constraint specified before a shorter, more restrictive sub-path constraint can be incorrectly matched first, causing the stricter constraint to be bypassed. The vulnerability is exploitable remotely over the network with no authentication required and no user interaction needed. An attacker can access protected resources that should be denied by the more restrictive constraint. Patches are available in Tomcat 11.0.25, 10.1.58, 9.0.121, and later maintenance releases for older branches (8.5.101, 7.0.110).

## Affected products

- Apache Tomcat 7.0.0-7.0.109
- Apache Tomcat 8.5.0-8.5.100
- Apache Tomcat 9.0.0-M1-9.0.120
- Apache Tomcat 10.1.0-M1-10.1.57
- Apache Tomcat 11.0.0-M1-11.0.24

## Identifiers

- CVE-2026-65182
- GHSA-gcx9-497g-6cp6

## Timeline

- 2026-08-26: disclosed
- 2026-08-26: patched: Patches released for versions 11.0.25, 10.1.58, 9.0.121, and later maintenance releases for 8.5.x and 7.0.x

## References

- [https://api.github.com/users/oscerd](https://api.github.com/users/oscerd)
- [https://github.com/oscerd](https://github.com/oscerd)
- [https://api.github.com/users/oscerd/gists%7B/gist_id%7D](https://api.github.com/users/oscerd/gists%7B/gist_id%7D)
- [https://api.github.com/users/oscerd/repos](https://api.github.com/users/oscerd/repos)
- [https://avatars.githubusercontent.com/u/5106647?v=4](https://avatars.githubusercontent.com/u/5106647?v=4)
- [https://api.github.com/users/oscerd/events%7B/privacy%7D](https://api.github.com/users/oscerd/events%7B/privacy%7D)

## Related threats

- [Apache Tomcat Jakarta Security credential handler bypass](https://junglewise.ai/threats/cve-2026-111248-the-jakarta-security-identity-store-backed-by-the-tomcat-user)
- [Apache Tomcat incomplete cleanup in TLS 1.3 connections](https://junglewise.ai/threats/cve-2026-93446-incomplete-cleanup-vulnerability-in-apache-tomcat-could-cause-tls)
- [Apache Tomcat HTTP trailer information leak between requests](https://junglewise.ai/threats/cve-2026-88041-incomplete-cleanup-vulnerability-in-apache-tomcat-allowed-an)
- [Apache Tomcat TOCTOU race condition in APR/Native connector](https://junglewise.ai/threats/cve-2026-80353-time-of-check-time-of-use-toctou-race-condition-vulnerability-in)
- [Apache Tomcat Execution After Redirect vulnerability](https://junglewise.ai/threats/cve-2026-74049-execution-after-redirect-ear-vulnerability-in-apache-tomcat-this)