Summary
CVE-2026-65182 is an improper access control / incorrect authorization vulnerability in Apache Tomcat’s security constraint processing. When a <security-constraint> is defined for a longer URL path before a more restrictive constraint defined for a shorter sub-path, Tomcat can apply the constraints in the wrong order, causing the more restrictive rule to be bypassed. This is a network-exploitable, unauthenticated issue rated CRITICAL (CVSS 9.1) that can expose protected resources to unauthorized users.
Technical details
- Root cause: Tomcat’s constraint-matching logic evaluates security constraints against request paths without correctly prioritizing more restrictive sub-path constraints over less restrictive parent-path constraints.
- Trigger condition: a deployment where a security constraint for a longer path (e.g.
/admin/sensitive/) is declared before a more restrictive constraint for a shorter sub-path (e.g./admin/) inweb.xmlor equivalent configuration. - Attack vector: network, no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N).
- Impact: unauthorized access to resources that should be protected by access-control constraints, resulting in high confidentiality and integrity impact; no availability impact.
Affected software
- Apache Tomcat 11.0.0-M1 through 11.0.24
- Apache Tomcat 10.1.0-M1 through 10.1.57
- Apache Tomcat 9.0.0.M1 through 9.0.120
- Apache Tomcat 8.5.0 through 8.5.100
- Apache Tomcat 7.0.0 through 7.0.109
Severity
- CVSS v3.1 Base Score: 9.1 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Mitigation and recommended actions
- Immediate: upgrade to Apache Tomcat 11.0.25, 10.1.58, or 9.0.121, which contain the fix.
- Note: Tomcat 8.5.x and 7.0.x are listed as affected version ranges but are past their end-of-life support windows and no fixed release is available for these branches; organizations running these versions should migrate to a supported, patched branch (9.0.121+, 10.1.58+, or 11.0.25+).
- If immediate patching is not possible: review and reorder
<security-constraint>declarations so that constraints for shorter, more restrictive sub-paths are defined before constraints for longer parent paths, and audit access logs for unauthorized access to protected resources.

