Executive brief
Apache Tomcat is a widely-used application server that enforces URL-based security restrictions to control access to sensitive web resources. A flaw in how these restrictions are processed allows an attacker to bypass security controls if a constraint protecting a longer URL path is defined before a more specific constraint protecting a shorter sub-path. This could permit unauthorized access to protected resources, exposing sensitive data or functionality to remote attackers without authentication.
Technical details
This vulnerability is an improper access control issue (CWE-284) in Tomcat's security constraint matching logic. When security constraints are configured, a longer path constraint specified before a shorter, more restrictive sub-path constraint can be incorrectly matched first, causing the stricter constraint to be bypassed. The vulnerability is exploitable remotely over the network with no authentication required and no user interaction needed. An attacker can access protected resources that should be denied by the more restrictive constraint. Patches are available in Tomcat 11.0.25, 10.1.58, 9.0.121, and later maintenance releases for older branches (8.5.101, 7.0.110).
Affected products
- Apache Tomcat 7.0.0-7.0.109
- Apache Tomcat 8.5.0-8.5.100
- Apache Tomcat 9.0.0-M1-9.0.120
- Apache Tomcat 10.1.0-M1-10.1.57
- Apache Tomcat 11.0.0-M1-11.0.24
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: Patches released for versions 11.0.25, 10.1.58, 9.0.121, and later maintenance releases for 8.5.x and 7.0.x