CVE-2026-53404
published 2026-06-29CVE-2026-53404: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched…
PriorityP351high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EPSS
0.65%
51.0th percentile
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | >= 10.1.0 < 10.1.56 | 10.1.56 |
| apache | tomcat | >= 11.0.0 < 11.0.23 | 11.0.23 |
| apache | tomcat | 8.5.0 – 8.5.100 | — |
| apache | tomcat | >= 9.0.0 < 9.0.119 | 9.0.119 |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.55 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.22 | — |
| apache_software_foundation | apache_tomcat | 8.5.0 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.0.M1 – 9.0.118 | — |
| debian | tomcat10 | — | — |
| debian | tomcat11 | — | — |
| debian | tomcat9 | — | — |
| pki-deps_10.6 | pki-servlet-engine | — | — |
| ubuntu | tomcat8 | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
vendor_ubuntu9.1CRITICAL
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2026-07-15·CVSS 9.1
CVE-2026-50229 [CRITICAL] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat incorrectly handled authorization when
multiple method constraints defined the same HTTP method. A remote
attacker could possibly use this issue to bypass authorization
restrictions. (CVE-2026-43515)
It was discovered that the Tomcat number guess example application did
not properly sanitize user-supplied input. An attacker could possibly
use this issue to inject malicious scripts, resulting in cross-site
scripting. (CVE-2026-50229)
It was discovered that Tomcat incorrectly evaluated rewrite valve
conditions in certain configurations. An attacker could possibly use
this issue to bypass rewrite rules, resulting in unauthorized access.
(CVE-2026-53404)
It was discovered tha
Red Hat
Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing
vendor_redhat·2026-06-29·CVSS 6.5
CVE-2026-53404 [MEDIUM] CWE-358 Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing
Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing
A flaw was found in Apache Tomcat's rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended rule processing, potentially allowing for security bypasses or unauthorized access due to misapplied configurations.
Statement: A flaw was found in Apache Tomcat's RewriteValve. When rewrite rules use OR-chained conditions followed by non-OR conditions, the processing logic may not evaluate conditions correctly, potentially allowing unintended rule matches. Exploitation requires the RewriteVal
VulDB
Apache Tomcat up to 11.0.22 control flow (EUVD-2026-40227)
vuldb·2026-06-30
CVE-2026-53404 [CRITICAL] Apache Tomcat up to 11.0.22 control flow (EUVD-2026-40227)
A vulnerability was found in Apache Tomcat up to 7.x/8.5.100/9.0.118/10.1.55/11.0.22. It has been rated as critical. Affected is an unknown function. Performing a manipulation results in incorrect control flow.
This vulnerability was named CVE-2026-53404. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is advised.
GHSA
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.
ghsa_unreviewed·2026-06-29
CVE-2026-53404 [HIGH] CWE-670 Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-53404 tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing [fedora-all]
bugzilla·2026-06-29
CVE-2026-53404 [MEDIUM] CVE-2026-53404 tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing [fedora-all]
CVE-2026-53404 tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to up
Bugzilla
CVE-2026-53404 Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing
bugzilla·2026-06-29
CVE-2026-53404 [MEDIUM] CVE-2026-53404 Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing
CVE-2026-53404 Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
2026-06-29
Published