Is CVE-2026-24733 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24733 being exploited in the wild.

How severe is CVE-2026-24733?

Medium severity, with a CVSS score of 4, published 17 February 2026.

Which products and versions are affected?

Apache Tomcat 9.0.0.M1 to 9.0.112, 10.1.0-M1 to 10.1.49, 11.0.0-M1 to 11.0.14; org.apache.tomcat:tomcat-coyote (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.15.

Is there a fix for CVE-2026-24733?

Yes. org.apache.tomcat:tomcat-coyote (Maven): upgrade to 11.0.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-24733 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-24733?

Check whether you run Apache Tomcat or org.apache.tomcat:tomcat-coyote (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24733: Apache Tomcat security constraint bypass in HTTP/0.9 handling

CVE-2026-24733 · Severity: medium · CVSS 4 · Published 2026-02-17

Apache Tomcat is a widely used web server for hosting Java applications. A flaw in how it handles older web communication standards (HTTP/0.9) could allow an attacker to bypass certain security rules. If a specific web page is set to allow 'HEAD' requests but block 'GET' requests, an attacker could use this bug to view the content they were supposed to be blocked from seeing.

Technologies: Apache Tomcat, org.apache.tomcat:tomcat-coyote (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-24733 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24733 being exploited in the wild.
How severe is CVE-2026-24733?: Medium severity, with a CVSS score of 4, published 17 February 2026.
Which products and versions are affected?: Apache Tomcat 9.0.0.M1 to 9.0.112, 10.1.0-M1 to 10.1.49, 11.0.0-M1 to 11.0.14; org.apache.tomcat:tomcat-coyote (Maven) ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.15.
Is there a fix for CVE-2026-24733?: Yes. org.apache.tomcat:tomcat-coyote (Maven): upgrade to 11.0.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-24733 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-24733?: Check whether you run Apache Tomcat or org.apache.tomcat:tomcat-coyote (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.tomcat:tomcat-coyote (Maven): upgrade to 11.0.15 or later

# set org.apache.tomcat:tomcat-coyote to 11.0.15 in your pom.xml or build.gradle

Technical details

An improper input validation vulnerability exists in Apache Tomcat's Coyote connector. Tomcat fails to properly restrict HTTP/0.9 requests to the GET method as required by modern interpretations of the legacy protocol. If a security constraint is configured to permit HEAD requests while denying GET requests for a specific URI, an attacker can bypass this restriction. By sending a malformed HTTP/0.9 request using the HEAD method, the attacker can effectively execute a GET request against the protected resource. The vulnerability is fixed in versions 9.0.113, 10.1.50, and 11.0.15.

Affected products

Apache Tomcat 9.0.0.M1 to 9.0.112, 10.1.0-M1 to 10.1.49, 11.0.0-M1 to 11.0.14

Identifiers

CVE-2026-24733
GHSA-qq5r-98hh-rxc9

Timeline

2026-02-17: disclosed
2026-02-17: advisory
2026-02-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.