CVE-2026-74049
published 2026-10-20CVE-2026-74049: Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through…
PriorityP336low3.7
EPSS
0.26%
17.6th percentile
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.60 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.26 | — |
| apache_software_foundation | apache_tomcat | 7.0.0 – 7.0.109 | — |
| apache_software_foundation | apache_tomcat | 8.5.0 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.0.M1 – 9.0.122 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
vendor_redhat·2026-10-20·CVSS 3.7
CVE-2026-74049 [LOW] CWE-698 tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
tomcat: Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE)
A flaw was found in Apache Tomcat. The application fails to halt execution after sending an HTTP redirect response, resulting in an Execution After Redirect (EAR) condition. A remote attacker could exploit this flaw by ignoring the redirect instruction to access responses generated after the redirect, potentially leading to unauthorized information disclosure.
GHSA
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
ghsa_unreviewed·2026-10-20
CVE-2026-74049 CWE-698 Execution After Redirect (EAR) vulnerability in Apache Tomcat.
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-74049 tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) [fedora-44]
bugzilla·2026-10-22
CVE-2026-74049 [LOW] CVE-2026-74049 tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) [fedora-44]
CVE-2026-74049 tomcat: Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE) [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61, 9
Bugzilla
CVE-2026-74049 tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) [fedora-rawhide]
bugzilla·2026-10-22
CVE-2026-74049 [LOW] CVE-2026-74049 tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) [fedora-rawhide]
CVE-2026-74049 tomcat: Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE) [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.
Bugzilla
CVE-2026-74049 tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) [fedora-43]
bugzilla·2026-10-22
CVE-2026-74049 [LOW] CVE-2026-74049 tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) [fedora-43]
CVE-2026-74049 tomcat: Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE) [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61, 9
Bugzilla
CVE-2026-74049 tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
bugzilla·2026-10-20
CVE-2026-74049 [LOW] CVE-2026-74049 tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
CVE-2026-74049 tomcat: Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE)
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
2026-10-20
Published