Skip to main content

Apache Tomcat EUVDEUVD-2026-40227

| CVE-2026-53404 HIGH
Always-Incorrect Control Flow Implementation (CWE-670)
2026-06-29 apache GHSA-h792-v28v-ppgr
Information Disclosure Tomcat Apache Apache Tomcat Red Hat Suse
7.3
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
7.3 LOW
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
vuln.today AI
4.8 MEDIUM

Remote and unauthenticated (AV:N/PR:N), but requires a non-default OR-chained rewrite configuration so AC:H; impact is access-control bypass / information disclosure with no real availability effect, hence C:L/I:L/A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

5
Analysis Updated
Jun 30, 2026 - 13:33 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 13:32 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 30, 2026 - 13:22 vuln.today
cvss_changed
CVSS changed
Jun 30, 2026 - 13:22 NVD
7.3 (HIGH)
Analysis Generated
Jun 29, 2026 - 21:18 vuln.today

DescriptionCVE.org

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

AnalysisAI

Access-control bypass in Apache Tomcat's RewriteValve (versions 8.5.0-8.5.100, 9.0.0.M1-9.0.118, 10.1.0-M1-10.1.55, and 11.0.0-M1-11.0.22) arises because once the first condition in an OR ([OR]) chain matched, subsequent non-OR conditions were never evaluated. Where operators rely on chained rewrite conditions to gate or restrict requests, an attacker can satisfy only the first condition and have later guard conditions silently skipped, leading to information disclosure or unintended request routing. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Apache has released fixes in 11.0.23, 10.1.56, and 9.0.119.

Technical ContextAI

The flaw lives in Tomcat's rewrite engine (the org.apache.catalina.valves.rewrite.RewriteValve), a mod_rewrite-style mechanism configured via rewrite.config that evaluates RewriteCond directives before applying a RewriteRule. Multiple conditions can be combined with the [OR] (ornext) flag; correct semantics require that conditions without [OR] are still AND-evaluated against the accumulated result. This is a CWE-670 (Always-Incorrect Control Flow Implementation) defect: the short-circuit evaluation of an OR group incorrectly treated a single early match as final, bypassing remaining mandatory (AND) conditions in the same chain. The affected component is bundled in the core Tomcat servlet container (cpe:2.3:a:apache_software_foundation:apache_tomcat), so any deployment using rewrite rules that mix OR and AND conditions for security or routing decisions inherits the logic error.

RemediationAI

Vendor-released patch: upgrade to Apache Tomcat 11.0.23, 10.1.56, or 9.0.119 (matching your branch), as directed in the Apache advisory at https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz. If an immediate upgrade is not possible, audit every rewrite.config / RewriteValve definition and restructure any rule that relies on [OR] chains for security gating - replace OR-grouped guard conditions with separate explicit RewriteRule blocks so each mandatory condition is independently enforced, accepting that this makes configs more verbose; alternatively, temporarily disable the RewriteValve where it is used only for non-essential URL rewriting, accepting loss of that rewriting behavior. Validate changes by re-testing the access paths the conditions were meant to protect. Additional references: https://seclists.org/oss-sec/2026/q2/1070 and https://vuldb.com/vuln/374704.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2014-0227 MEDIUM
6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and
CVE-2026-34486 HIGH POC
7.5 Apr 09

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi
CVE-2013-5528 MEDIUM POC
4.0 Oct 11

Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager all
CVE-2016-6808 CRITICAL POC
9.8 Apr 12

Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42. Rated critical severity (CVSS 9.8), this vulnerabili
CVE-2016-1240 HIGH POC
7.8 Oct 03

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debia

Same weakness CWE-670 – Always-Incorrect Control Flow Implementation

View all
CVE-2020-17466 CRITICAL POC
9.8
CVE-2025-29312 CRITICAL POC
9.1
CVE-2018-16766 HIGH POC
8.8
CVE-2026-26267 HIGH POC
7.5
CVE-2024-53270 HIGH POC
7.5
CVE-2024-53269 HIGH POC
7.5
CVE-2024-37153 HIGH POC
7.5
CVE-2023-41376 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed

Share

EUVD-2026-40227 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy