REDHAT-BUG-2499917: Low severity Apache Tomcat vulnerability
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.24 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.57 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.120
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2499917?
The severity of REDHAT-BUG-2499917 is classified as low.
How do I fix REDHAT-BUG-2499917?
To fix REDHAT-BUG-2499917, upgrade Apache Tomcat to a version that is not affected, specifically above 11.0.23, 10.1.56, 9.0.119, or 8.5.0.
What systems are affected by REDHAT-BUG-2499917?
The systems affected by REDHAT-BUG-2499917 include Apache Tomcat versions from 11.0.0-M1 through 11.0.23, 10.1.0-M1 through 10.1.56, 9.0.0.M1 through 9.0.119, and 8.5.0.
What type of vulnerability is REDHAT-BUG-2499917?
REDHAT-BUG-2499917 is an improper handling of URL encoding (hex encoding) vulnerability that allows for security constraint bypass.
When was REDHAT-BUG-2499917 published?
REDHAT-BUG-2499917 was published on July 14, 2026.