CVE-2026-59083
published 2026-07-14CVE-2026-59083: Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations…
PriorityP260critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.37%
29.7th percentile
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | <= 8.0.0 | — |
| apache | tomcat | — | — |
| apache | tomcat | 10.1.0 – 10.1.56 | — |
| apache | tomcat | 11.0.0 – 11.0.23 | — |
| apache | tomcat | 8.5.0 – 8.5.100 | — |
| apache | tomcat | 9.0.0 – 9.0.119 | — |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.56 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.23 | — |
| apache_software_foundation | apache_tomcat | 8.5.0 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.0.M1 – 9.0.119 | — |
| debian | tomcat10 | — | — |
| debian | tomcat11 | — | — |
| debian | tomcat9 | — | — |
| pki-deps_10.6 | pki-servlet-engine | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve
vendor_redhat·2026-07-14·CVSS 9.1
CVE-2026-59083 [CRITICAL] CWE-807 tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve
tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding (hex encoding). A remote attacker could exploit this to bypass security constraints in certain conf
VulDB
Apache Tomcat up to 11.0.23/10.1.56/9.0.119/8.5.100 Rewrite Valve encoding error (EUVD-2026-43638)
vuldb·2026-07-14·CVSS 9.1
CVE-2026-59083 [CRITICAL] Apache Tomcat up to 11.0.23/10.1.56/9.0.119/8.5.100 Rewrite Valve encoding error (EUVD-2026-43638)
A vulnerability classified as problematic has been found in Apache Tomcat up to 11.0.23/10.1.56/9.0.119/8.5.100. This affects an unknown function of the component Rewrite Valve. This manipulation causes encoding error.
This vulnerability is registered as CVE-2026-59083. Remote exploitation of the attack is possible. No exploit is available.
GHSA
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
ghsa_unreviewed·2026-07-14
CVE-2026-59083 [CRITICAL] CWE-177 Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59083 tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve [fedora-all]
bugzilla·2026-07-29·CVSS 9.1
CVE-2026-59083 [CRITICAL] CVE-2026-59083 tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve [fedora-all]
CVE-2026-59083 tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.
Bugzilla
CVE-2026-59083 tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve
bugzilla·2026-07-14·CVSS 9.1
CVE-2026-59083 [CRITICAL] CVE-2026-59083 tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve
CVE-2026-59083 tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
2026-07-14
Published