CVE-2026-24733
Apache Tomcat: Security constraint bypass with HTTP/0.9
MEDIUM 6.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.55 % · percentile 46 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112. Older, EOL versions are also affected. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
Weaknesses (CWE)
- CWE-20 — Improper Input Validation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | CISA-ADP |
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-qq5r-98hh-rxc9 — Apache Tomcat - Security constraint bypass with HTTP/0.9
European references
- ENISA EUVD · EUVD-2026-7831
- GCVE · GCVE-0-2026-24733
CERT-FR advisories
- CERTFR-2026-AVI-1121 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0500 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0326 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0322 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0315 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0209 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0199 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 9.0.1 < 9.0.113cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 10.1.1 < 10.1.50cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 11.0.1 < 11.0.15cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone10:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:*- +26 more
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Tomcat | affected 11.0.0-M1 ≤ 11.0.14 ; affected 10.1.0-M1 ≤ 10.1.49 ; affected 9.0.0.M1 ≤ 9.0.112 ; affected 0 ≤ 8.5.100 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |