CVE-2026-65927

Analyzed Analyzed - Analysis Complete

Off-by-one Error in Apache Tomcat Rewrite Valve

Publication date: 2026-08-25

Last updated on: 2026-08-27

Assigner: Apache Software Foundation

Description

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-27

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-65927

EUVD

EUVD-2026-66130

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 10.1.0 (inc) to 10.1.58 (exc)
apache	tomcat	From 11.0.0 (inc) to 11.0.25 (exc)
apache	tomcat	From 8.5.0 (inc) to 9.0.121 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-193	A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Attack-Flow Graph

Executive Summary

This is an off-by-one error in Apache Tomcat's rewrite valves. When the [N] flag is used, the rewrite processing incorrectly restarts at the second rule instead of the first rule, causing unexpected behavior in URL rewriting.

Detection Guidance

Detection involves checking the Apache Tomcat version. Run 'catalina.sh version' or 'bin/version.sh' in the Tomcat directory to verify if your version falls within the affected ranges (11.0.0-M1 to 11.0.24, 10.1.0-M1 to 10.1.57, 9.0.0.M1 to 9.0.120, or 8.5.0 to 8.5.100).

Impact Analysis

It may lead to incorrect URL rewrites, breaking links or routing in web applications. This could disrupt user access to resources or expose unintended content.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it is specific to Apache Tomcat's rewrite valve functionality and does not involve data breaches or unauthorized access.

Mitigation Strategies

Upgrade Apache Tomcat to a patched version: 11.0.25, 10.1.58, or 9.0.121. If using an unsupported version like 8.5.x, upgrade to a supported release or apply vendor patches if available.

Hi! I’m here to help you understand CVE-2026-65927. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70