Apache Tomcat fixes security control bypass and multiple configuration flaws
Patch & Detection Intelligence · 8 sources · Updated 2mo ago · First seen Jul 14, 2026
Apache Tomcat released security updates addressing several vulnerabilities across supported branches, including CVE-2026-59083, an incorrect URL decoding flaw in RewriteValve that can let attackers bypass security constraints in some configurations, and CVE-2026-59084, a documentation-related weakness that left EncryptInterceptor deployments without clearly defined secure configuration requirements. Apache said affected versions span Tomcat 11, 10.1, 9.0, and 8.5 releases, with some unsupported end-of-life versions potentially exposed as well.
Separate Tomcat advisories also described additional patched issues, including CVE-2026-53434, an invalid CRL configuration vulnerability rated CVSS 9.1, CVE-2026-50229, a cross-site scripting flaw in the Number Guess example, and other fixes tracked as CVE-2026-53404, CVE-2026-55276, CVE-2026-55955, and CVE-2026-55956. Organizations were urged to test and deploy updated releases, with Apache recommending upgrades to 11.0.24, 10.1.57, and 9.0.120 to remediate the newly disclosed issues.
