CVE-2026-74049: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0 through 11.0.26, from 10.1.0 through 10.1.60, from 9.0.0 through 9.0.122.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
Other sources
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 9.0.123 - Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 10.1.61 - Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 11.0.27 - Upgrade
Upgrade
debian/tomcat9to a version that resolves this vulnerability.Fixed in 9.0.70-2 - Upgrade
Upgrade
debian/tomcat9to a version that resolves this vulnerability.Fixed in 9.0.70-2Fixed in 9.0.95-1Fixed in 9.0.122-1 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.27 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.61 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.123
Event History
Frequently Asked Questions
Which release lines contain the fix?
Upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123. These versions fix the issue.
Are end-of-life Tomcat versions affected?
Known affected end-of-life releases include Tomcat 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
How can I determine whether an installation needs remediation?
Check the installed Tomcat version against the affected ranges. Versions from 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122 require upgrade.