Vulnerability Directory | CVE-2026-24733 | Apache Tomcat

Overview

Apache Tomcat is an open-source web server and servlet container developed by the Apache Software Foundation. It implements several Java Enterprise Edition (Java EE) specifications including Java Servlet, JavaServer Pages (JSP), and WebSocket, allowing it to run Java web applications. Tomcat is widely used in both development and production environments due to its lightweight nature, ease of configuration, and compatibility with various Java applications.

‍

An Improper Input Validation vulnerability (CVE-2026-24733) has been identified in Apache Tomcat where Tomcat does not limit HTTP/0.9 requests to the GET method.

‍

An Improper Input Validation vulnerability occurs when a product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

‍

This issue affects multiple versions of Apache Tomcat below 11.0.15.

‍

Details

Module Info

Product: Apache Tomcat
Affected packages: tomcat, tomcat-coyote
Affected versions: >=8.5.0 <=8.5.100, >=9.0.0.M1 <9.0.113, >=10.1.0-M1 <10.1.50, >=11.0.0-M1 <11.0.15
GitHub repository: https://github.com/apache/tomcat

Published packages:
- https://central.sonatype.com/artifact/org.apache.tomcat/tomcat
- https://central.sonatype.com/artifact/org.apache.tomcat/tomcat-coyote

Package manager: Maven
Fixed in: NES for Tomcat 8.5.104

‍

Vulnerability Info

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

‍

Mitigation

Only recent versions of Apache Tomcat are community-supported. The community support version will not receive any updates to address this issue. For more information, see here.

‍

Users of the affected components should apply one of the following mitigations: