CVE-2026-65927
N/A
N/A
Summary
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | 11.0.0-M1 <= 11.0.24 | affected |
| Apache Software Foundation | Apache Tomcat | 10.1.0-M1 <= 10.1.57 | affected |
| Apache Software Foundation | Apache Tomcat | 9.0.0.M1 <= 9.0.120 | affected |
| Apache Software Foundation | Apache Tomcat | 8.5.0 <= 8.5.100 | affected |
| Apache Software Foundation | Apache Tomcat | 7.0.0 <= 7.0.109 | unaffected |
| Apache Software Foundation | Apache Tomcat | 0 < 7.0.0 | unaffected |
Weaknesses
- CWE-193: CWE-193 Off-by-one Error
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.