CVE-2026-74049

Overview

Apache Tomcat is an open-source implementation of the Jakarta Servlet, Jakarta Pages, Jakarta Expression Language, Jakarta WebSocket, Jakarta Annotations, and Jakarta Authentication specifications. It serves Java web applications either as a standalone servlet container and HTTP server or embedded inside an application through the tomcat-embed-core artifact. Its Catalina servlet container (org.apache.tomcat:tomcat-catalina) supplies the request-processing pipeline, including Valves such as RewriteValve, along with connectors, realms, and session management.

An authorization bypass vulnerability (CVE-2026-74049) has been identified in the Jasper JSP engine's tag plugin for the JSTL <c:redirect> tag, which allows attackers to have the rest of a JSP page execute after the page has issued a redirect (execution after redirect). When a page uses <c:redirect> to send unauthenticated or unauthorized users away from protected logic, that logic still runs for them.

Per OWASP: Execution After Redirect (EAR) is an attack where an attacker ignores redirects and retrieves sensitive content intended for authenticated users. A successful EAR exploit can lead to complete compromise of the application.

This issue affects multiple versions of Apache Tomcat, including the End-of-Life 7.0.x and 8.5.x lines.

Details

Module Info

• Product: Apache Tomcat
• Affected packages: org.apache.tomcat:tomcat-jasper, org.apache.tomcat.embed:tomcat-embed-jasper
• Affected versions: >=7.0.0 <=7.0.109, >=8.5.0 <=8.5.100, >=9.0.0.M1 <=9.0.122, >=10.1.0-M1 <=10.1.60, >=11.0.0-M1 <=11.0.26
• GitHub repository: https://github.com/apache/tomcat
• Published packages: https://central.sonatype.com/artifact/org.apache.tomcat/tomcat-jasper, https://central.sonatype.com/artifact/org.apache.tomcat.embed/tomcat-embed-jasper
• Package manager: Maven
• Fixed in:
• OSS Apache Tomcat 9.0.123, 10.1.61, 11.0.27
• NES for Apache Tomcat 8.5.100-tomcat-8.5.113

Vulnerability Info

This Low-severity vulnerability is found in the org.apache.tomcat:tomcat-jasper package (and its embedded counterpart org.apache.tomcat.embed:tomcat-embed-jasper) in multiple versions of Apache Tomcat.

Jasper can replace selected JSTL tags with tag plugins, which generate inline Java code in the compiled JSP instead of calling the JSTL tag handler. Tag plugins are applied when a web application configures them through /WEB-INF/tagPlugins.xml or a META-INF/org.apache.jasper/tagPlugins.xml resource on its class path. The plugin for <c:redirect> is org.apache.jasper.tagplugins.jstl.core.Redirect. The JSTL tag handler ends page processing after a redirect by returning SKIP_PAGE, but the code generated by the plugin only calls sendRedirect():

//do redirect
ctxt.generateJavaSource("try{");
ctxt.generateJavaSource("    " + responseName + ".sendRedirect(" + resultName + ");");
ctxt.generateJavaSource("}catch(java.io.IOException ex){");
ctxt.generateJavaSource("    throw new JspTagException(ex.toString(), ex);");
ctxt.generateJavaSource("}");

Nothing after the try block returns from _jspService() or throws SkipPageException, so control falls through to the remainder of the page. Any scriptlets, custom tags, includes or database and state-changing actions placed after the <c:redirect> are still executed for the redirected request. A page that relies on a conditional <c:redirect> as an access check (for example, redirecting users without a valid session to a login page) therefore performs the protected work anyway.

Mitigation

Only recent versions of Apache Tomcat are community-supported. The community support version will not receive any updates to address this issue. For more information, see here.

The End-of-Life Apache Tomcat 7.0.x and 8.5.x lines have no publicly available fix.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a patched version of Apache Tomcat.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• 0xCc.zhang (finder)