REDHAT-BUG-2476519: Medium severity Apache Tomcat vulnerability
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.22 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.55 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.118
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2476519?
The severity of REDHAT-BUG-2476519 is medium, with a risk score of 4.
What is the impact of REDHAT-BUG-2476519?
REDHAT-BUG-2476519 involves an improper authorization vulnerability that can allow unauthorized access due to conflicting method constraints in Apache Tomcat.
How do I fix REDHAT-BUG-2476519?
To resolve REDHAT-BUG-2476519, upgrade to a patched version of Apache Tomcat that addresses this vulnerability.
Which versions of Apache Tomcat are affected by REDHAT-BUG-2476519?
Apache Tomcat versions from 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 are affected by REDHAT-BUG-2476519.
When was REDHAT-BUG-2476519 published?
REDHAT-BUG-2476519 was published on May 12, 2026.