What’s Vulnerable › Vulnerabilities

CVE-2026-59083: Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-07-14
• Weakness: CWE-177

Description

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

Affected products

• Apache Tomcat: through 8.0.0; from 8.5.0 through 8.5.100; from 9.0.0 through 9.0.119; from 10.1.0 through 10.1.56; from 11.0.0 through 11.0.23

References

• https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq
• http://www.openwall.com/lists/oss-security/2026/07/14/7

Get alerted when CVE-2026-59083 or the next vulnerability affects your stack