CVE-2026-24733
Improper Input Validation in Apache Tomcat Enables Security Bypass
Publication date: 2026-02-17
Last updated on: 2026-03-11
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 9.0.0 |
| apache | tomcat | 10.0.0 |
| apache | tomcat | 10.0.0 |
| apache | tomcat | 10.0.0 |
| apache | tomcat | 10.0.0 |
| apache | tomcat | 10.0.0 |
| apache | tomcat | 10.0.0 |
| apache | tomcat | 10.0.0 |
| apache | tomcat | 10.0.0 |
| apache | tomcat | 10.0.0 |
| apache | tomcat | 10.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | 11.0.0 |
| apache | tomcat | From 10.1.1 (inc) to 10.1.50 (exc) |
| apache | tomcat | From 11.0.1 (inc) to 11.0.15 (exc) |
| apache | tomcat | From 9.0.1 (inc) to 9.0.113 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves Apache Tomcat improperly handling HTTP/0.9 requests, allowing bypass of security constraints by sending a HEAD request using HTTP/0.9.
To detect this vulnerability on your system or network, you can attempt to send HTTP/0.9 HEAD requests to your Tomcat server and observe if security constraints are bypassed.
Since HTTP/0.9 is an obsolete protocol, many common tools do not support it directly. However, you can use low-level tools like netcat (nc) or telnet to manually craft such requests.
- Use netcat to send a raw HTTP/0.9 HEAD request: echo -e "HEAD /path HTTP/0.9\r\n" | nc your-tomcat-server 80
- Use telnet to connect to the server and manually type the HTTP/0.9 HEAD request: telnet your-tomcat-server 80, then type: HEAD /path HTTP/0.9
If the server responds to these requests and bypasses configured security constraints (e.g., allows access where GET is denied), the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate mitigation is to upgrade Apache Tomcat to a fixed version.
- Upgrade to Apache Tomcat version 11.0.15 or later.
- Or upgrade to version 10.1.50 or later.
- Or upgrade to version 9.0.113 or later.
These versions contain the fix that properly limits HTTP/0.9 requests and prevents bypassing security constraints.
Can you explain this vulnerability to me?
This vulnerability is an Improper Input Validation issue in Apache Tomcat where the server did not properly limit HTTP/0.9 requests to only the GET method.
Specifically, if a security constraint was set to allow HEAD requests to a URI but deny GET requests, an attacker could bypass this restriction by sending a HEAD request using the HTTP/0.9 protocol, which is invalid according to specifications.
How can this vulnerability impact me? :
This vulnerability allows an attacker to bypass security constraints that are intended to restrict GET requests by exploiting the handling of HTTP/0.9 HEAD requests.
As a result, unauthorized access to resources that should be protected from GET requests could occur, potentially exposing sensitive information or functionality.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know