Executive brief
Apache Tomcat, a widely used web server for Java applications, contains a flaw in how it processes URL redirection and rewriting rules. This issue could cause the server to skip certain security or routing conditions, potentially leading to unexpected behavior in how web traffic is handled. Organizations should update to the latest versions to ensure their web traffic rules are applied correctly.
Technical details
An Always-Incorrect Control Flow Implementation (CWE-670) exists in Apache Tomcat's rewrite valve. When processing rewrite rules, if the first condition in an OR chain matches, the engine incorrectly skips subsequent non-OR conditions that should have been evaluated. This logic error can lead to the bypass of intended rewrite constraints or security conditions defined in the configuration. The vulnerability is reachable via network requests that trigger the affected rewrite rules. Patches are available in versions 11.0.23, 10.1.56, and 9.0.119.
Affected products
- Apache Tomcat 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, 8.5.0 through 8.5.100
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory