Loading vulnerability…
Access-control bypass in Apache Tomcat RewriteValve [N] processing
CVE-2026-65927 is an off-by-one error in Apache Tomcat RewriteValve handling of the [N] flag. When a matching rewrite rule requests a new processing pass, processing incorrectly resumes at the second rule instead of the first. Skipping the first rule can bypass access-control logic that must be reapplied to the rewritten request. Affected versions are 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120. End-of-life versions 8.5.0 through 8.5.100 are also affected; other unsupported versions may be affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker may bypass access controls implemented through rewrite rules and access resources or application functionality that the skipped rule would otherwise restrict. The actual consequences depend on the rewrite configuration and the resources protected by it. SUSE assigns a CVSS v3.1 score of 7.5 with high availability impact, while the CNA assessment assigns 7.3 with low confidentiality, integrity, and availability impacts. These assessments differ; a specific denial-of-service mechanism is not established.
If you can’t patch tonight, do this now.
Until patched, identify RewriteValve configurations using the [N] flag and disable or revise the affected rules where operationally feasible, ensuring that access-control checks cannot be skipped on subsequent rewrite passes. Enforce compensating access controls independently of the affected rewrite logic. Reduce exposure using reverse-proxy access restrictions, firewall allowlists, and network segmentation.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.25 or later, 10.1.58 or later, or 9.0.121 or later within the applicable release branch. Migrate affected end-of-life Tomcat 8.5 installations to a supported, fixed release. For vendor-packaged or embedded Tomcat deployments, install the corresponding vendor security update rather than independently replacing bundled components. Identified fixed downstream releases include Red Hat JBoss Web Server 6.2.5 and 7.0.2, Atlassian Confluence 9.2.26, 10.2.19, and 11.0.0, and Jira Service Management 10.3.25 and 11.3.11, as applicable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.