CVE-2026-65927: Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.25 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.58 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.121
Event History
Frequently Asked Questions
Which Tomcat deployments are exposed?
Affected release lines are 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120. The unsupported 8.5.0 through 8.5.100 releases are also known to be affected, and other unsupported versions may be affected.
What must an attacker be able to do to exploit this issue?
The CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges, and no user interaction required. The impact is availability only; the supplied vector lists no confidentiality or integrity impact.
What should teams do to remediate it?
Upgrade to Tomcat 11.0.25, 10.1.58, or 9.0.121, as applicable. These versions fix the issue.