PT-2026-20316 · Apache · Apache Tomcat

Mark Thomas · Published 2025-12-08 · Updated 2026-03-23 · CVE-2026-24733

Positive Technologies · (AI Summary)

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.14 Apache Tomcat versions 10.1.0-M1 through 10.1.49 Apache Tomcat versions 9.0.0-M1 through 9.0.112 Older, End-of-Life (EOL) versions are also affected

Description Apache Tomcat does not properly limit HTTP/0.9 requests to the GET method. This allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to allow HEAD requests to a Uniform Resource Identifier (URI) but denies GET requests to the same URI, a user can circumvent this restriction on GET requests by sending a specification-invalid HEAD request using HTTP/0.9. This is achieved by sending a crafted HTTP/0.9-style request that bypasses the intended enforcement of security constraints. The issue occurs when a Tomcat security constraint allows HEAD requests while denying GET requests to the same URI.

Recommendations Upgrade to Apache Tomcat version 11.0.15 or later. Upgrade to Apache Tomcat version 10.1.50 or later. Upgrade to Apache Tomcat version 9.0.113 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-TOMCAT-2026-24733

CVE-2026-24733

GHSA-QQ5R-98HH-RXC9

MGASA-2026-0056

OPENSUSE-SU-2026:10305-1

OPENSUSE-SU-2026:10306-1

OPENSUSE-SU-2026:10307-1

OPENSUSE-SU-2026:20350-1

SUSE-SU-2026:0877-1

SUSE-SU-2026:0890-1

SUSE-SU-2026:0922-1

SUSE-SU-2026:0932-1

Affected Products

Apache Tomcat

References · 60

• https://osv.dev/vulnerability/BIT-tomcat-2026-24733 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0056 · Vendor Advisory
• https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qq5r-98hh-rxc9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24733 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0890-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10305-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-24733 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10306-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0932-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-24733 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-24733 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10307-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0877-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0922-1 · Vendor Advisory