Loading vulnerability…
Execution After Redirect in Apache Tomcat Jasper JSTL
CVE-2026-74049 is an Execution After Redirect vulnerability in Apache Tomcat's Jasper JSTL redirect tag plug-in. The implementation omits the SKIP_PAGE page-abort behavior, allowing remaining JSP page code to execute after an HTTP redirect instead of terminating page processing. Affected versions are 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122. End-of-life versions 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are also affected; other unsupported versions may be affected. Apache rates the vulnerability as low severity.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Application code following a JSTL redirect may execute unexpectedly. If an application relies on the redirect to prevent subsequent sensitive operations, this behavior could undermine application security controls or cause unintended state changes. The actual impact depends on the code following the redirect; arbitrary attacker-supplied code execution and specific confidentiality, integrity, or availability consequences are not established.
If you can’t patch tonight, do this now.
No vendor-specified interim mitigation or workaround is available.
Patch, then assume compromise.
Upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123, or a later fixed release within the corresponding supported branch. Migrate affected end-of-life Tomcat 8.5 and 7.0 installations to a supported, fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.