Executive brief
Apache Tomcat, a widely used web server for Java applications, contains a vulnerability in its URL rewriting component. In specific configurations, an attacker could use specially formatted web addresses to bypass security rules intended to restrict access to sensitive areas of the application. This could allow unauthorized users to view protected data or access administrative functions they should not be able to reach.
Technical details
A vulnerability exists in the Apache Tomcat rewrite valve (RewriteValve) due to improper handling of URL hex encoding. When specific rewrite rules are in place, the component fails to correctly normalize or interpret encoded characters, potentially allowing a request to bypass security constraints defined in web.xml or other security configurations. The attack is delivered via the network without requiring authentication, provided the target server uses the affected rewrite valve configuration. The issue is resolved in versions 11.0.24, 10.1.57, and 9.0.120.
Affected products
- Apache Tomcat 11.0.0-M1 to 11.0.23, 10.1.0-M1 to 10.1.56, 9.0.0.M1 to 9.0.119, 8.5.0 to 8.5.100
Timeline
- 2026-07-14: advisory
- 2026-07-14: disclosed