Loading story…
Apache Tomcat released security updates addressing several vulnerabilities across supported branches, including CVE-2026-59083, an incorrect URL decoding flaw in RewriteValve that can let attackers bypass security constraints in some configurations, and CVE-2026-59084, a documentation-related weakness that left EncryptInterceptor deployments without clearly defined secure configuration requirements. Apache said affected versions span Tomcat 11, 10.1, 9.0, and 8.5 releases, with some unsupported end-of-life versions potentially exposed as well.
Separate Tomcat advisories also described additional patched issues, including CVE-2026-53434, an invalid CRL configuration vulnerability rated CVSS 9.1, CVE-2026-50229, a cross-site scripting flaw in the Number Guess example, and other fixes tracked as CVE-2026-53404, CVE-2026-55276, CVE-2026-55955, and CVE-2026-55956. Organizations were urged to test and deploy updated releases, with Apache recommending upgrades to 11.0.24, 10.1.57, and 9.0.120 to remediate the newly disclosed issues.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Apache disclosed CVE-2026-59084, a low-severity issue stemming from unclear documentation for securely configuring EncryptInterceptor across multiple Tomcat branches. Apache advised users to upgrade to 11.0.24, 10.1.57, or 9.0.120, and credited NDIx as the reporter.
Apache Tomcat disclosed CVE-2026-59083, a low-severity vulnerability in RewriteValve caused by incorrect URL hex decoding that may allow security constraint bypass in some configurations. Apache recommended upgrading to 11.0.24, 10.1.57, or 9.0.120.
On 2026-07-01, Apache Tomcat released a security update addressing multiple vulnerabilities, including CVE-2026-53434, CVE-2026-50229, CVE-2026-53404, CVE-2026-55276, CVE-2026-55955, and CVE-2026-55956. The issues included cross-site scripting and security restriction bypass risks, and organizations were advised to deploy the patch after testing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcelists.apache.org
Open sourceopenwall.com
Open sourceseclists.org
Open sourceegfincirt.org.eg
Open sourceegfincirt-wpn.azurewebsites.net
Open sourcetomcat.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-59083**, a vulnerability in Tomcat's `RewriteValve` caused by incorrect URL decoding of hex-encoded characters that can let attackers bypass security controls in some configurations. The issue is classified as **CWE-177** and was described as low severity by Apache, though the CVE record notes network attackability with low attack complexity, no privileges required, and no user interaction. Apache said the flaw affects supported Tomcat branches **11.0.0-M1 through 11.0.23**, **10.1.0-M1 through 10.1.56**, and **9.0.0.M1 through 9.0.119**, with reports also listing **8.5.0 through 8.5.100** as affected. Apache and downstream advisories urged users to upgrade to fixed releases **11.0.24**, **10.1.57**, or **9.0.120**, while warning that older unsupported versions may also be vulnerable; versions before **8.0.0** were noted as unaffected in the oss-security disclosure. The vulnerability was published through Apache security pages, the Apache mailing list, and `oss-security`, with the CVE entry updated to include affected-version details, a CVSS v3.1 vector, and a CISA SSVC assessment.
Jul 15, 2026
Apache Tomcat released security updates addressing two critical vulnerabilities: a URL rewrite bypass (CVE-2025-55752) that could allow directory traversal and potential remote code execution (RCE) if the HTTP PUT method is enabled, and a console ANSI injection flaw (CVE-2025-55754) that could enable manipulation of log messages via escape sequences. The affected versions include Tomcat 11.0.0-M1 to 11.0.10, 10.1.0-M1 to 10.1.44, and 9.0.0.M11 to 9.0.108, with users and administrators urged to apply the necessary patches immediately to mitigate risk. The URL rewrite bypass vulnerability allows attackers to craft malicious requests that evade security controls, potentially leading to unauthorized file access or code execution on vulnerable servers. The console ANSI injection issue could be exploited to alter log output, possibly obscuring malicious activity or facilitating further attacks. Security advisories from both Apache and national cybersecurity authorities emphasize the importance of prompt remediation to prevent exploitation in the wild.
Jun 29, 2026
Two significant vulnerabilities have been identified in Apache Tomcat, each with distinct attack vectors and impacts. CVE-2025-61795 is an improper resource shutdown or release vulnerability that can lead to a denial-of-service (DoS) condition if temporary files from multipart uploads are not cleaned up promptly, potentially exhausting disk space and exposing sensitive data. This issue affects Tomcat versions 11.0.0-M1 through 11.0.11, 10.1.0-M1 through 10.1.46, 9.0.0.M1 through 9.0.109, and several end-of-life versions, with patches available in 11.0.12, 10.1.47, and 9.0.110 and later. CVE-2025-55752 is a relative path traversal vulnerability introduced by a regression in the fix for a previous bug, allowing attackers to bypass security constraints and potentially upload malicious files if specific, non-default configurations are present. This vulnerability affects Tomcat versions 11.0.0-M1 through 11.0.10, 10.1.0-M1 through 10.1.44, 9.0.0.M11 through 9.0.108, and certain EOL versions, with fixes in 11.0.11, 10.1.45, and 9.0.109 and later. Both vulnerabilities require prompt attention from administrators, especially those running affected Tomcat versions. The DoS vulnerability (CVE-2025-61795) can be exploited by attackers to exhaust server resources, while the path traversal flaw (CVE-2025-55752) could lead to remote code execution under specific conditions. Organizations are advised to upgrade to the latest patched versions to mitigate these risks and review their Tomcat configurations to ensure that non-default features such as HTTP PUT requests and URL rewriting are not unnecessarily enabled.
Jun 29, 2026