Executive brief
Apache Tomcat is a widely used web server and application container for Java-based websites. A security flaw was discovered where the server fails to apply all intended access restrictions when multiple security rules are defined for the same file type. This could allow an unauthorized user to bypass security checks and access sensitive data or perform restricted actions on the server.
Technical details
An improper authorization vulnerability exists in Apache Tomcat's RealmBase component. When a configuration defines multiple security constraints for the same extension pattern (e.g., *.jsp) using different HTTP method constraints, the server only applies the first matching constraint and ignores subsequent ones. This allows remote, unauthenticated attackers to bypass intended access controls by using HTTP methods that should have been restricted by the ignored constraints. The issue is resolved in versions 11.0.22, 10.1.55, and 9.0.118.
Affected products
- Apache Tomcat 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.0.M1 to 9.0.117, 8.5.0 to 8.5.100, 7.0.0 to 7.0.109
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
References
- https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb
- http://www.openwall.com/lists/oss-security/2026/05/12/11
- https://github.com/apache/tomcat/commit/276087d9c7abbcecc6c4fb4e4b08cf64780c6e36
- https://github.com/apache/tomcat/commit/c621317382682206fb58ab92ebd3e1b6fdd10ce9
- https://github.com/apache/tomcat/commit/db919ff9912b4d61d1b702a1342b8bde39270031