Apache Tomcat RewriteValve Flaw Enables Security Constraint Bypass

Apache disclosed CVE-2026-59083, a vulnerability in Tomcat's RewriteValve caused by incorrect URL decoding of hex-encoded characters that can let attackers bypass security controls in some configurations. The issue is classified as CWE-177 and was described as low severity by Apache, though the CVE record notes network attackability with low attack complexity, no privileges required, and no user interaction. Apache said the flaw affects supported Tomcat branches 11.0.0-M1 through 11.0.23, 10.1.0-M1 through 10.1.56, and 9.0.0.M1 through 9.0.119, with reports also listing 8.5.0 through 8.5.100 as affected.

Apache and downstream advisories urged users to upgrade to fixed releases 11.0.24, 10.1.57, or 9.0.120, while warning that older unsupported versions may also be vulnerable; versions before 8.0.0 were noted as unaffected in the oss-security disclosure. The vulnerability was published through Apache security pages, the Apache mailing list, and oss-security, with the CVE entry updated to include affected-version details, a CVSS v3.1 vector, and a CISA SSVC assessment.