Loading vulnerability…
Apache Tomcat RewriteValve URL-Encoding Security Constraint Bypass
CVE-2026-59083 is an improper handling of URL hex encoding vulnerability in Apache Tomcat's RewriteValve that allows remote attackers to bypass security constraints in certain configurations. Affected versions are 11.0.0-M1 through 11.0.23, 10.1.0-M1 through 10.1.56, 9.0.0.M1 through 9.0.119, and 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Exploitation can permit unauthorized access to protected application resources.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can bypass configured security constraints, exposing protected resources to unauthorized access or modification. The vulnerability has a CVSS v3.0 score of 9.1, with high confidentiality and integrity impacts and no availability impact indicated. Actual exposure depends on the application's RewriteValve configuration and protected functionality.
If you can’t patch tonight, do this now.
Review deployments using RewriteValve and verify enforcement of security constraints and access controls. No validated vulnerability-specific interim workaround is established; configuration review is not a substitute for installing a fixed release.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.24 or later, 10.1.57 or later, or 9.0.120 or later within the corresponding release branch. For vendor-packaged installations, apply the applicable vendor security update. No fixed 8.5.x release is identified; migrate affected 8.5.x and other unsupported installations to a supported, patched release.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
52 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.