Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcat | Oct 11, 2026 | Sep 17, 2026 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-lib | Aug 2, 2026 | Aug 2, 2026 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.120Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 10.1.57Upgrade Apache Tomcat to 11.0.24 | Jul 16, 2026 | Jul 14, 2026 |
| Debian | — | Upgrade tomcat9 | Jul 19, 2026 | Jul 19, 2026 |
| Redhat_linux | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade jws7-tomcat-docs-webappUpgrade tomcat9-admin-webappsUpgrade jws6-tomcat-selinuxUpgrade tomcat9-servlet-4.0-apiUpgrade jws7-tomcat-servlet-6.0-apiUpgrade jws7-tomcat-admin-webappsUpgrade tomcat-admin-webappsUpgrade jws7-tomcat-javadocNo solution existsUpgrade tomcat9-libUpgrade tomcat-webappsUpgrade tomcat9Upgrade tomcat-servlet-4.0-apiUpgrade jws6-tomcatUpgrade jws7-tomcat-webappsUpgrade jws7-tomcat-el-5.0-apiUpgrade jws6-tomcat-jsp-3.1-apiUpgrade jws6-tomcat-servlet-6.0-apiUpgrade jws6-tomcat-webappsUpgrade tomcat9-el-3.0-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade jws6-tomcat-javadocUpgrade tomcat9-webappsUpgrade jws6-tomcat-admin-webappsUpgrade jws7-tomcat-selinuxUpgrade jws7-tomcat-libUpgrade tomcat-el-3.0-apiUpgrade jws6-tomcat-el-5.0-apiUpgrade tomcat9-docs-webappUpgrade jws6-tomcat-libUpgrade jws7-tomcatUpgrade tomcat9-jsp-2.3-apiUpgrade jws6-tomcat-docs-webappUpgrade jws7-tomcat-jsp-3.1-api | Jul 31, 2026 | Jul 14, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 23, 2026 | Jul 14, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub