CVE-2026-59083CWE-177

Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

Critical · published July 14, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
29.7
In the wild
Unconfirmed
What it is

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00370 · 29.7th percentile
Weakness
CWE-177 · Improper Handling of URL Encoding (Hex Encoding)
Published
2026-07-14T08:13Z
EPSS history
Timeline
  • 14 JUL 08:13Z
    Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
    cvelistv5