BIT-tomcat-2026-74049: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0 through 11.0.26, from 10.1.0 through 10.1.60, from 9.0.0 through 9.0.122.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 9.0.123 - Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 10.1.61 - Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 11.0.27 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.27 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.61 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.123
Event History
Frequently Asked Questions
Which Tomcat release lines need to be upgraded?
Affected supported releases are Tomcat 11.0.0 through 11.0.26, 10.1.0 through 10.1.60, and 9.0.0 through 9.0.122. Upgrade to 11.0.27, 10.1.61, or 9.0.123, respectively.
Are end-of-life Tomcat versions affected?
Yes. Tomcat 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are known to be affected, and other unsupported versions may also be affected. These versions should be moved to a supported fixed release line.