CVE-2026-53404

Overview

Apache Tomcat is an open-source web server and servlet container, maintained by the Apache Software Foundation, that implements the Jakarta Servlet, Jakarta Pages (JSP), Jakarta Expression Language, and Jakarta WebSocket specifications and provides a pure-Java HTTP environment for running Java web applications.

An incorrectly configured access control vulnerability (CVE-2026-53404) has been identified in the Apache Tomcat RewriteValve, which allows requests that should have been excluded by a rewrite rule’s conditions to instead match that rule. When a RewriteCond carrying the [OR] (ornext) flag matched, condition processing over-advanced and skipped the first following mandatory (non-OR) condition, so a rewrite could fire for requests the deployer intended to exclude.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions.

This issue affects multiple versions of Apache Tomcat below 11.0.23.

‍

Details

Module Info

• Product: Apache Tomcat
• Affected packages: tomcat-catalina, tomcat-embed-core
• Affected versions: >=8.5.0 <=8.5.100, >=9.0.0.M1 <9.0.119, >=10.1.0-M1 <10.1.56, >=11.0.0-M1 <11.0.23
• GitHub repository:https://github.com/apache/tomcat

• Published packages:
  
  • https://central.sonatype.com/artifact/org.apache.tomcat/tomcat-catalina 
  • https://central.sonatype.com/artifact/org.apache.tomcat.embed/tomcat-embed-core 

• Package manager: Maven
• Fixed in:
  
  • NES for Apache Tomcat 8.5.100-tomcat-8.5.107
  • Apache Tomcat 11.0.23, 10.1.56, 9.0.119 (OSS)

Vulnerability Info

This Low-severity vulnerability is found in the org.apache.tomcat:tomcat-catalina package in the 8.5.x line of Apache Tomcat, in the org.apache.catalina.valves.rewrite rewrite engine. The RewriteValve lets a deployer rewrite, redirect, or block requests using a rewrite.config file modeled on Apache mod_rewrite, where each rule can be gated by a list of RewriteCond conditions. Conditions are evaluated in sequence; a condition marked [OR] (ornext) is satisfied if it or a later condition in the OR chain matches, while a condition without [OR] is a mandatory AND gate that must match on its own.

When evaluating a rule’s conditions, after a condition matched, the engine advanced its position counter past the entire OR chain and then advanced once more, landing past the first following mandatory condition without ever evaluating it:

while (pos < conditions.length && conditions[pos].isOrnext()) {
  pos++;
}

For a rule whose condition list contains an [OR] flag followed by at least one further mandatory condition, once an earlier OR member matched, that trailing mandatory condition was skipped. The rule then fired even though the mandatory gate was never checked, so requests the deployer intended to exclude could be rewritten, redirected, or forwarded. This diverges from Apache mod_rewrite’s purely sequential [OR] semantics, and the practical impact depends entirely on the deployer’s specific rewrite ruleset.

This vulnerability has been present since at least Apache Tomcat 8.5.0 and likely earlier.

Mitigation

Only recent versions of Apache Tomcat are community-supported. The community support version will not receive any updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a patched version of Apache Tomcat.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Apache Tomcat security team