EUVD-2026-66130
GHSA-g8qj-vp23-742m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated trigger via HTTP; rewrite rule configuration with [N] flag is an operator-set condition, not an attacker-controlled complexity, so AC:L is retained; impact is availability only per description.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.
AnalysisAI
Rewrite valve processing in Apache Tomcat contains an off-by-one error (CWE-193) in the handling of the [N] (Next) flag, causing rule iteration to restart from the second rewrite rule instead of the first, which can produce unintended looping behavior and result in a denial-of-service condition. Affected supported versions span Tomcat 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, and 11.0.0-M1 through 11.0.24; the EOL 8.5.x branch is also affected but will not receive a fix. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Apache Tomcat rewrite valve is enabled and at least one configured rewrite rule uses the [N] (Next) flag, which instructs the engine to restart ruleset processing after a match. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 and indicates a network-accessible denial-of-service with no authentication or interaction requirement from the attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends repeated HTTP requests to a Tomcat instance whose rewrite valve is configured with rules using the [N] flag for iterative URL substitution. Due to the off-by-one error, the engine bypasses the first rule on each restart, skipping a guard or convergence condition and entering a near-infinite processing loop for affected requests. … |
| Remediation | Upgrade Apache Tomcat to version 11.0.25, 10.1.58, or 9.0.121, which resolve the off-by-one error per the Apache mailing list announcement at https://lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Tomcat deployments to identify affected versions (9.0.0-9.0.120, 10.1.0-10.1.57, 11.0.0-11.0.24, 8.5.x), document active rewrite rules, and assess business criticality of each instance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and
Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi
Same weakness CWE-193 – Off-by-one Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today