Skip to main content

Apache Tomcat CVE-2026-59083

| EUVDEUVD-2026-43638 CRITICAL
Improper Handling of URL Encoding (Hex Encoding) (CWE-177)
2026-07-14 apache GHSA-hcjr-322h-429r
Authentication Bypass Apache Tomcat Apache Tomcat Suse Red Hat
Critical
Disputed · 9.1 Vendor: apache
Share

Severity by source

Sources disagree (Low–High)
Vendor (apache) PRIMARY
9.1 LOW
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
9.1 CRITICAL

Remote unauthenticated encoded request bypasses constraints (AV:N/PR:N); high confidentiality/integrity to protected resources, no availability impact; config dependency treated as scope of exposure, not attack complexity, so AC:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Red Hat
3.7 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Updated
Jul 14, 2026 - 13:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 14, 2026 - 13:22 vuln.today
cvss_changed
CVSS changed
Jul 14, 2026 - 13:22 NVD
9.1 (CRITICAL)
Analysis Generated
Jul 14, 2026 - 08:49 vuln.today
CVE Published
Jul 14, 2026 - 08:13 cve.org
LOW

DescriptionCVE.org

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

Articles & Coverage 2

News 3 New Apache Vulnerabilities - 2 Critical, 1 High Severity Jul 15, 2026 News Critical Security Constraint Bypass in Apache Tomcat - CVE-2026-59083 Jul 14, 2026

AnalysisAI

Security constraint bypass in Apache Tomcat (8.5.0-8.5.100, 9.0.0.M1-9.0.119, 10.1.0-M1-10.1.56, 11.0.0-M1-11.0.23) lets remote attackers reach protected resources by abusing improperly handled hex URL encoding in the RewriteValve, defeating URL-pattern security constraints. Because the flaw resides in the rewrite valve, only deployments that use the RewriteValve together with security constraints are exposed, but where present an unauthenticated attacker (per CVSS PR:N) can access or manipulate resources meant to be restricted. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

Apache Tomcat is a widely deployed Java servlet container and web server. The RewriteValve is Tomcat's mod_rewrite-style URL rewriting engine, configured via rewrite.config with RewriteRule/RewriteCond directives, and it processes the request URI before Tomcat's container-managed security constraints (defined in web.xml <security-constraint> elements) are matched against the path. The root cause maps to CWE-177 (Improper Handling of URL Encoding, i.e. hex escapes such as %2e/%2f): the valve does not consistently normalize percent-encoded octets before or after rewriting, so an encoded request path can be interpreted differently by the constraint-matching layer than by the resource-serving layer. This encoding/normalization mismatch is a classic path-equivalence problem - the same file can be addressed by an encoded form that the security-constraint matcher fails to recognize as protected. The single provided CPE, cpe:2.3:a:apache_software_foundation:apache_tomcat:*, confirms the core Tomcat product across all listed 8.5/9.0/10.1/11.0 branches is affected.

RemediationAI

Vendor-released patch: upgrade to Apache Tomcat 11.0.24, 10.1.57, or 9.0.120, which fix the issue on the respective 11.0.x, 10.1.x, and 9.0.x branches. Users on the 8.5.x branch should note that 8.5 has reached end of life (8.5.100 is the final release and no fixed 8.5 build is listed); those deployments must migrate to a supported 9.0.120+/10.1.57+/11.0.24+ branch rather than patch in place. If immediate upgrade is not possible, the most direct compensating control is to reconsider reliance on the RewriteValve for enforcing access control: either disable the RewriteValve if it is not required, or move authorization enforcement off URL-pattern security constraints and onto a mechanism not bypassed by encoding (e.g. front-end reverse-proxy/WAF rules that reject or canonicalize percent-encoded path segments like %2e and %2f before they reach Tomcat) - with the trade-off that overly strict encoding rejection can break legitimately encoded URLs. Confirm details against the Apache advisory at https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2020-13935 HIGH POC
7.5 Jul 14

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2020-9484 HIGH POC
7.0 May 20

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
CVE-2014-0227 MEDIUM
6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and
CVE-2026-34486 HIGH POC
7.5 Apr 09

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi

Same weakness CWE-177 – Improper Handling of URL Encoding (Hex Encoding)

View all
CVE-2022-27780 HIGH POC
7.5
CVE-2018-3718 MEDIUM POC
5.3
CVE-2026-22037 HIGH
8.4
CVE-2026-22031 HIGH
8.4
CVE-2026-15371 HIGH
8.1
CVE-2026-76172 HIGH POC
7.5
CVE-2026-29045 HIGH
7.5
CVE-2026-67448 MEDIUM
6.5

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

CVE-2026-59083 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy