CVE-2026-76183
Fixed in a distro release EPSS <1%CVSS 9.8
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Products: Apache Software Foundation Apache Tomcat
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | tomcat10 | no fix |
| Debian:12 | tomcat9 | 9.0.70-2 |
| Debian:13 | tomcat10 | no fix |
| Debian:13 | tomcat11 | no fix |
| Debian:13 | tomcat9 | 9.0.70-2 |
| Debian:14 | tomcat10 | 10.1.60-1 |
| Debian:14 | tomcat11 | no fix |
| Debian:14 | tomcat9 | 9.0.70-2 |
| Red Hat:hummingbird:1 | tomcat10 | 0:10.1.60-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat10-admin-webapps | 0:10.1.60-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat10-common | 0:10.1.60-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat10-docs-webapp | 0:10.1.60-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat10-el-5.0-api | 0:10.1.60-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat10-jsp-3.1-api | 0:10.1.60-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat10-lib | 0:10.1.60-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat10-servlet-6.0-api | 0:10.1.60-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat10-user-instance | 0:10.1.60-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat10-webapps | 0:10.1.60-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat11 | 0:11.0.26-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat11-admin-webapps | 0:11.0.26-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat11-common | 0:11.0.26-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat11-docs-webapp | 0:11.0.26-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat11-el-6.0-api | 0:11.0.26-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat11-jsp-4.0-api | 0:11.0.26-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat11-lib | 0:11.0.26-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat11-servlet-6.1-api | 0:11.0.26-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat11-user-instance | 0:11.0.26-0.1.hum1 |
| Red Hat:hummingbird:1 | tomcat11-webapps | 0:11.0.26-0.1.hum1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | libtcnative-1-0 | 1.3.9-150200.6.11.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | tomcat | 9.0.122-150200.123.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | libtcnative-1-0 | 1.3.9-150200.6.11.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | tomcat | 9.0.122-150200.123.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | libtcnative-1-0 | 1.3.9-150200.6.11.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | tomcat | 9.0.122-150200.123.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | tomcat10 | 10.1.60-150200.5.82.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | libtcnative-1-0 | 1.3.9-150200.6.11.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | tomcat | 9.0.122-150200.123.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | tomcat10 | 10.1.60-150200.5.82.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libtcnative-1-0 | 1.3.9-150600.16.9.2 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | libtcnative-1-0 | 1.3.9-150600.16.9.2 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | tomcat | 9.0.122-150200.123.2 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | tomcat10 | 10.1.60-150200.5.82.2 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | tomcat11 | 11.0.26-150600.13.36.2 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | libtcnative-1-0 | 1.3.9-150200.6.11.2 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | tomcat | 9.0.122-150200.123.2 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | libtcnative-1-0 | 1.3.9-150200.6.11.2 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | tomcat | 9.0.122-150200.123.2 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | tomcat10 | 10.1.60-150200.5.82.2 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | libtcnative-1-0 | 1.3.9-150600.16.9.2 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | tomcat | 9.0.122-150200.123.2 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | tomcat10 | 10.1.60-150200.5.82.2 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | tomcat11 | 11.0.26-150600.13.36.2 |
| SUSE:Linux Enterprise Server 16.0 | libtcnative-1-0 | 1.3.9-160000.1.1 |
| SUSE:Linux Enterprise Server 16.0 | libtcnative-2-0 | 2.0.16-160000.1.1 |
| SUSE:Linux Enterprise Server 16.0 | tomcat | 9.0.122-160000.1.1 |
| SUSE:Linux Enterprise Server 16.0 | tomcat10 | 10.1.60-160000.1.1 |
| SUSE:Linux Enterprise Server 16.0 | tomcat11 | 11.0.26-160000.1.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | libtcnative-1-0 | 1.3.9-150200.6.11.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | tomcat | 9.0.122-150200.123.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | libtcnative-1-0 | 1.3.9-150200.6.11.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | tomcat | 9.0.122-150200.123.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | tomcat10 | 10.1.60-150200.5.82.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | libtcnative-1-0 | 1.3.9-150600.16.9.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | tomcat | 9.0.122-150200.123.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | tomcat10 | 10.1.60-150200.5.82.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | tomcat11 | 11.0.26-150600.13.36.2 |
| SUSE:Linux Enterprise Server for SAP applications 16.0 | libtcnative-1-0 | 1.3.9-160000.1.1 |
| SUSE:Linux Enterprise Server for SAP applications 16.0 | libtcnative-2-0 | 2.0.16-160000.1.1 |
| SUSE:Linux Enterprise Server for SAP applications 16.0 | tomcat | 9.0.122-160000.1.1 |
| SUSE:Linux Enterprise Server for SAP applications 16.0 | tomcat10 | 10.1.60-160000.1.1 |
| SUSE:Linux Enterprise Server for SAP applications 16.0 | tomcat11 | 11.0.26-160000.1.1 |
| Ubuntu:24.04:LTS | tomcat10 | no fix |
| Ubuntu:24.04:LTS | tomcat9 | no fix |
| Ubuntu:26.04:LTS | tomcat10 | no fix |
| Ubuntu:26.04:LTS | tomcat11 | no fix |
| Ubuntu:26.04:LTS | tomcat9 | no fix |
| Ubuntu:26.10 | tomcat10 | no fix |
| Ubuntu:26.10 | tomcat11 | no fix |
| Ubuntu:26.10 | tomcat9 | no fix |
| Ubuntu:Pro:14.04:LTS | tomcat6 | no fix |
| Ubuntu:Pro:14.04:LTS | tomcat7 | no fix |
| Ubuntu:Pro:16.04:LTS | tomcat7 | no fix |
| Ubuntu:Pro:16.04:LTS | tomcat8 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat8 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat9 | no fix |
| Ubuntu:Pro:20.04:LTS | tomcat9 | no fix |
| Ubuntu:Pro:22.04:LTS | tomcat9 | no fix |
| openSUSE:Leap 16.0 | libtcnative-1-0 | 1.3.9-160000.1.1 |
| openSUSE:Leap 16.0 | libtcnative-2-0 | 2.0.16-160000.1.1 |
| openSUSE:Leap 16.0 | tomcat | 9.0.122-160000.1.1 |
| openSUSE:Leap 16.0 | tomcat10 | 10.1.60-160000.1.1 |
| openSUSE:Leap 16.0 | tomcat11 | 11.0.26-160000.1.1 |
| openSUSE:Tumbleweed | tomcat | 9.0.122-1.1 |
| openSUSE:Tumbleweed | tomcat10 | 10.1.60-1.1 |
| openSUSE:Tumbleweed | tomcat11 | 11.0.26-1.1 |