This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Apache Tomcat fixes a critical vulnerability
Apache Tomcat fixes 1 critical vulnerability in versions 11.0.24, 10.1.57 and 9.0.120 [1]. It also draws attention to an error in the documentation [2]. For stable Debian releases, security fixes have been issued only in the tomcat9 package, in version 9.0.118-0+deb11u1 for bullseye (security) and in version 9.0.70-2 for bookworm [3]. Red Hat and Ubuntu [4] have not yet provided fixes, or their releases are not affected by the vulnerability. The Gentoo distribution has fixed versions available in testing for the amd64 and arm64 architectures [5].
An unauthenticated remote attacker can, by sending a specially encoded URL request, bypass security restrictions and access controls in the RewriteValve component [1].
The vulnerability is present in product:
- Apache Tomcat; <=9.0.119; >=10.1.0-M1, <=10.1.56; >=11.0.0-M1, <=11.0.23;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2026-59083 at cve.org, NVD
- CWE-177: Improper Handling of URL Encoding (Hex Encoding) at cwe.mitre.org
The vulnerability was publicly disclosed 14. 7. 2026.
Links
- [1] https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq
- [2] https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7
- [3] https://security-tracker.debian.org/tracker/CVE-2026-59083
- [4] https://ubuntu.com/security/CVE-2026-59083
- [5] https://packages.gentoo.org/packages/www-servers/tomcat
By CESNET, z.s.p.o. Ondrej Pavlovič on 21. 7. 2026.