Executive brief
Apache Tomcat is a widely used web server for hosting Java applications. A flaw in how it handles older web communication standards (HTTP/0.9) could allow an attacker to bypass certain security rules. If a specific web page is set to allow 'HEAD' requests but block 'GET' requests, an attacker could use this bug to view the content they were supposed to be blocked from seeing.
Technical details
An improper input validation vulnerability exists in Apache Tomcat's Coyote connector. Tomcat fails to properly restrict HTTP/0.9 requests to the GET method as required by modern interpretations of the legacy protocol. If a security constraint is configured to permit HEAD requests while denying GET requests for a specific URI, an attacker can bypass this restriction. By sending a malformed HTTP/0.9 request using the HEAD method, the attacker can effectively execute a GET request against the protected resource. The vulnerability is fixed in versions 9.0.113, 10.1.50, and 11.0.15.
Affected products
- Apache Tomcat 9.0.0.M1 to 9.0.112, 10.1.0-M1 to 10.1.49, 11.0.0-M1 to 11.0.14
Timeline
- 2026-02-17: disclosed
- 2026-02-17: advisory
- 2026-02-19: patched