Executive brief
Apache Tomcat, a widely used web server and application container, is vulnerable to an open redirect flaw. This issue occurs when the server incorrectly handles certain web requests, allowing attackers to redirect users from a legitimate site to a malicious one. This can be used in phishing campaigns to trick users into providing credentials or downloading malware by making the malicious link appear to come from a trusted domain.
Technical details
An open redirect vulnerability exists in Apache Tomcat's LoadBalancerDrainingValve component. The vulnerability is caused by insufficient validation of user-supplied input used in URL redirection logic within the valve. A remote, unauthenticated attacker can exploit this by crafting a specific URL that, when visited by a victim, redirects them to an arbitrary external domain. This is classified as CWE-601 and requires minimal user interaction. The issue is resolved in versions 11.0.20, 10.1.53, and 9.0.116.
Affected products
- Apache Tomcat 11.0.0-M1 to 11.0.18, 10.1.0-M1 to 10.1.52, 9.0.0.M23 to 9.0.115, 8.5.30 to 8.5.100
Timeline
- 2026-04-09: disclosed
- 2026-04-09: advisory