CVE-2026-65927

Overview

Apache Tomcat is an open-source web server and servlet container, maintained by the Apache Software Foundation, that implements the Jakarta Servlet, Jakarta Pages (JSP), Jakarta Expression Language, and Jakarta WebSocket specifications and provides a pure-Java HTTP environment for running Java web applications.

An authorization bypass vulnerability (CVE-2026-65927) has been identified in the Apache Tomcat RewriteValve, which allows a request to reach a resource that the deployer's rewrite rules were written to block. A rule carrying the [N] (next) flag is documented to restart rule processing at the first rule, but processing restarted at the second rule instead, so the first rule in the rule set, commonly a deny or block rule guarding a path, was never applied to the rewritten request.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects the 8.5.x line of Apache Tomcat, from 8.5.0 through the final community release 8.5.100, as well as the maintained 9.0.x, 10.1.x, and 11.0.x lines, which Apache fixed in 9.0.121, 10.1.59, and 11.0.25.

Module Info

• Product: Apache Tomcat
• Affected packages: org.apache.tomcat:tomcat-catalina (embedded: org.apache.tomcat.embed:tomcat-embed-core)
• Affected versions: >=8.5.0 <=8.5.100
• GitHub repository: https://github.com/apache/tomcat
• Published packages: https://central.sonatype.com/artifact/org.apache.tomcat/tomcat-catalina
• Package manager: Maven
• Fixed in: NES for Apache Tomcat 8.5.100-tomcat-8.5.110 (upstream fixed in Apache Tomcat 9.0.121, 10.1.59, and 11.0.25)

Vulnerability Info

This High-severity vulnerability is found in the org.apache.tomcat:tomcat-catalina package in the 8.5.x line of Apache Tomcat, in the org.apache.catalina.valves.rewrite rewrite engine. The RewriteValve lets a deployer rewrite, redirect, or block requests using a rewrite.config file modeled on Apache mod_rewrite. Rules are evaluated in file order, and flags on a rule can change that flow: [F] (forbidden) answers the request with a 403, and [N] (next) is documented to re-run the rewriting process, starting again with the first rewriting rule.

Rules are walked by an indexed loop, for (int i = 0; i < rules.length; i++), and the [N] flag was handled inside that loop:

// - next (redo again)
if (rule.isNext() && newtest != null) {
    i = 0;
    continue;
}

continue runs the loop's own i++ step before the next iteration, so assigning i = 0 re-enters the loop body with i equal to 1, which is the second rule. Every restart triggered by an [N] rule therefore skips the first rule in the rule set.

When the first rule is the one that enforces a restriction, that skip is an access control bypass. Consider a rule set whose first rule denies a protected path and whose second rule rewrites requests into that path:

RewriteRule ^/protected - [F]
RewriteRule ^/x(.*) /protected$1 [N]

A request for /x/y does not match the first rule, matches the second, and is rewritten to /protected/y. Rule processing then restarts, but at the second rule, so the [F] rule that exists to deny /protected is never evaluated against the rewritten URL and the request is served instead of being rejected. The effect is not limited to deny rules: any first rule, whether it forbids, normalizes, or canonicalizes a path, loses its turn on every restart.

Exploitation requires the RewriteValve to be configured, which is not the case in Tomcat's stock configuration, with a rule set that uses the [N] flag and that relies on a rule ordered before the [N] rule to deny or reshape requests. Where that holds, the attacker-controlled input is simply the request URI, and no authentication or special privilege is needed. The Apache Tomcat security team rates this issue Important and published no CVSS vector for it.

Deployers whose rule sets place a self-matching [N] rule first, meaning a rule that rewrites a URL into a form the same rule matches again, should review those rules before moving to a fixed release. Such a rule terminates today only because the faulty restart skips it, and a restart that correctly begins at the first rule will match it round after round; the rewrite engine imposes no limit on the number of rounds.

The [N] handling has assigned i = 0 since the rewrite valve was first imported into Apache Tomcat in 2013, and the earlier 7.0.x line does not contain the rewrite valve at all. Apache does not list the 8.0.x line among the affected versions, and Apache Tomcat 8.5.0, the first release of the affected 8.5.x line, carries the defect unchanged, as does the final community release 8.5.100.

Mitigation

Only recent major lines of Apache Tomcat are community-supported. The affected 8.5.x line reached End-of-Life on March 31, 2024 (final community release 8.5.100) and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Apache Tomcat major line (9.0.x or later) that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• 4ra1n (finder)
• pyn3rd (finder)
• unam4 (finder)