CVE-2026-59083
published 2026-07-14CVE-2026-59083: Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations…
PriorityP262critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.38%
29.9th percentile
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | <= 8.0.0 | — |
| apache | tomcat | 10.1.0 – 10.1.56 | — |
| apache | tomcat | 11.0.0 – 11.0.23 | — |
| apache | tomcat | 8.5.0 – 8.5.100 | — |
| apache | tomcat | 9.0.0 – 9.0.119 | — |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.56 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.23 | — |
| apache_software_foundation | apache_tomcat | 8.5.0 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.0.M1 – 9.0.119 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Tomcat up to 11.0.23/10.1.56/9.0.119/8.5.100 Rewrite Valve encoding error (EUVD-2026-43638)
vuldb·2026-07-14·CVSS 9.1
CVE-2026-59083 [CRITICAL] Apache Tomcat up to 11.0.23/10.1.56/9.0.119/8.5.100 Rewrite Valve encoding error (EUVD-2026-43638)
A vulnerability classified as problematic has been found in Apache Tomcat up to 11.0.23/10.1.56/9.0.119/8.5.100. This affects an unknown function of the component Rewrite Valve. This manipulation causes encoding error.
This vulnerability is registered as CVE-2026-59083. Remote exploitation of the attack is possible. No exploit is available.
GHSA
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
ghsa_unreviewed·2026-07-14
CVE-2026-59083 [CRITICAL] CWE-177 Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-14
Published