Improper URL Encoding Handling in Apache Tomcat Affects Key Versions
CVE-2026-59083

9.1CRITICAL

Key Information:

Vendor

Apache
Status
Apache Tomcat
Vendor
CVE Published:
14 July 2026

What is CVE-2026-59083?

A vulnerability exists in Apache Tomcat's rewrite valve that allows for security constraint bypass due to improper handling of URL encoding (hex encoding). This issue affects multiple versions of Apache Tomcat, potentially exposing applications to unauthorized access. It is critical for users to update to the latest versions (11.0.24, 10.1.57, or 9.0.120) to mitigate this risk.

Affected Version(s)

Apache Tomcat 11.0.0-M1 <= 11.0.23

Apache Tomcat 10.1.0-M1 <= 10.1.56

Apache Tomcat 9.0.0.M1 <= 9.0.119

References

https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv...
vendor-advisory

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.