Apache Tomcat CVE-2026-65927

Exploitation requires that the Apache Tomcat rewrite valve is enabled and at least one configured rewrite rule uses the [N] (Next) flag, which instructs the engine to restart ruleset processing after a match. This is explicitly a non-default configuration - standard Tomcat installations without custom rewrite rules are entirely unaffected. The attacker must be able to send HTTP requests to the Tomcat service (network-reachable), but no authentication is required from the attacker's perspective once the configuration condition is present. Exploitation is further bounded by whether the attacker can reach a request path that matches and triggers the [N]-flag rule, meaning URL pattern coverage in the rewrite configuration defines the effective attack surface. Environments running Tomcat with the rewrite valve disabled or with rewrite rules that do not use the [N] flag are not affected by this vulnerability.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 and indicates a network-accessible denial-of-service with no authentication or interaction requirement from the attacker. This rating is conditionally accurate: exploitation requires the Tomcat rewrite valve to be actively configured with [N]-flag rules, which is a non-default deployment. EPSS at 0.20% (10th percentile) reflects very low observed exploitation probability in the wild, consistent with the absence of both a CISA KEV listing and public exploit code. A notable discrepancy exists: the intelligence feed tags this CVE as 'Information Disclosure,' which directly conflicts with the CVSS C:N/I:N assessment; no confidentiality or integrity impact is substantiated by the description or vector, and the tag may represent a misclassification or metadata error - defenders should verify against the authoritative Apache advisory before drawing conclusions about data exposure risk. Real-world priority is moderate: organizations running rewrite-heavy Tomcat deployments with [N]-flag rules should treat this as a scheduled patch, not an emergency, given low EPSS and no confirmed exploitation.

An attacker sends repeated HTTP requests to a Tomcat instance whose rewrite valve is configured with rules using the [N] flag for iterative URL substitution. Due to the off-by-one error, the engine bypasses the first rule on each restart, skipping a guard or convergence condition and entering a near-infinite processing loop for affected requests. Sustained request volume exploits this loop to exhaust Tomcat worker threads or CPU, rendering the application unavailable. No public proof-of-concept code is known at time of analysis.