# CVE-2026-53404: Apache Tomcat incorrect control flow in rewrite valve

Source: https://junglewise.ai/threats/cve-2026-53404-apache-tomcat-incorrect-control-flow-in-rewrite-valve  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-53404 · Severity: high · CVSS 7.3 · Published 2026-06-29

Apache Tomcat, a widely used web server for Java applications, contains a flaw in how it processes URL redirection and rewriting rules. This issue could cause the server to skip certain security or routing conditions, potentially leading to unexpected behavior in how web traffic is handled. Organizations should update to the latest versions to ensure their web traffic rules are applied correctly.

Technologies: [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat), [org.apache.tomcat:tomcat (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat), [org.apache.tomcat:tomcat-catalina (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina), [org.apache.tomcat.embed:tomcat-embed-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-53404 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53404 being exploited in the wild.

**How severe is CVE-2026-53404?** High severity, with a CVSS score of 7.3, published 29 June 2026.

**Which products and versions are affected?** Apache Tomcat 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, 8.5.0 through 8.5.100; org.apache.tomcat:tomcat (Maven) >= 11.0.0-M1, < 11.0.23, ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.23; org.apache.tomcat:tomcat-catalina (Maven) >= 11.0.0-M1, < 11.0.23, ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.23; org.apache.tomcat.embed:tomcat-embed-core (Maven) >= 11.0.0-M1, < 11.0.23, ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.23.

**Is there a fix for CVE-2026-53404?** Yes. org.apache.tomcat:tomcat (Maven): upgrade to 11.0.23 or later; org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.23 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53404 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53404?** Check whether you run Apache Tomcat, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.tomcat:tomcat (Maven): upgrade to 11.0.23 or later

  ```sh
  # set org.apache.tomcat:tomcat to 11.0.23 in your pom.xml or build.gradle
  ```

- org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.23 or later

  ```sh
  # set org.apache.tomcat:tomcat-catalina to 11.0.23 in your pom.xml or build.gradle
  ```

- org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.23 or later

  ```sh
  # set org.apache.tomcat.embed:tomcat-embed-core to 11.0.23 in your pom.xml or build.gradle
  ```


## Technical details

An Always-Incorrect Control Flow Implementation (CWE-670) exists in Apache Tomcat's rewrite valve. When processing rewrite rules, if the first condition in an OR chain matches, the engine incorrectly skips subsequent non-OR conditions that should have been evaluated. This logic error can lead to the bypass of intended rewrite constraints or security conditions defined in the configuration. The vulnerability is reachable via network requests that trigger the affected rewrite rules. Patches are available in versions 11.0.23, 10.1.56, and 9.0.119.

## Affected products

- Apache Tomcat 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, 8.5.0 through 8.5.100

## Identifiers

- CVE-2026-53404
- BIT-TOMCAT-2026-53404
- GHSA-h792-v28v-ppgr

## Timeline

- 2026-06-29: disclosed
- 2026-06-29: advisory

## References

- [https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz](https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz)

## Related threats

- [Apache Tomcat Jakarta Security credential handler bypass](https://junglewise.ai/threats/cve-2026-111248-the-jakarta-security-identity-store-backed-by-the-tomcat-user)
- [Apache Tomcat incomplete cleanup in TLS 1.3 connections](https://junglewise.ai/threats/cve-2026-93446-incomplete-cleanup-vulnerability-in-apache-tomcat-could-cause-tls)
- [Apache Tomcat HTTP trailer information leak between requests](https://junglewise.ai/threats/cve-2026-88041-incomplete-cleanup-vulnerability-in-apache-tomcat-allowed-an)
- [Apache Tomcat TOCTOU race condition in APR/Native connector](https://junglewise.ai/threats/cve-2026-80353-time-of-check-time-of-use-toctou-race-condition-vulnerability-in)
- [Apache Tomcat Execution After Redirect vulnerability](https://junglewise.ai/threats/cve-2026-74049-execution-after-redirect-ear-vulnerability-in-apache-tomcat-this)