Loading vulnerability…
Incorrect OR-chain processing in Apache Tomcat RewriteValve
CVE-2026-53404 is an incorrect control-flow vulnerability in Apache Tomcat's RewriteValve. When the first condition in an OR chain matches, subsequent non-OR conditions are incorrectly skipped, allowing rewrite rules to be processed without evaluating all required conditions. This can bypass intended request-routing logic or security checks that depend on those conditions. Affected releases are 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, and 8.5.0 through 8.5.100. Other end-of-support versions may also be affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Rewrite rules may execute even when subsequent mandatory conditions would not match. Depending on the deployed rewrite configuration, this can produce unintended request routing or bypass access-control logic implemented through rewrite conditions. The security impact depends on the purpose of the skipped conditions; arbitrary code execution and denial of service are not established for this vulnerability.
If you can’t patch tonight, do this now.
No separate workaround is documented for this vulnerability.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.23, 10.1.56, or 9.0.119, or a later fixed release in the corresponding branch. Migrate affected 8.5.x installations to a supported, fixed branch because no fixed 8.5.x release is identified. For affected bundled deployments, vendor fixes include Red Hat JBoss Web Server 6.2.4 and ExtremeAnalytics for Site Engine and ExtremeControl for Site Engine 26.8.10 or later.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.