CVE-2026-24733
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Description
A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0.9 protocol can bypass the intended denial rule, enabling an attacker to access resources that should be protected.
Metrics
Weakness classes (CWE)
CWE-20Class
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
cwe.mitre.org →
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
bitnami
tomcat10.0.0
bitnami
tomcat10.1.0
bitnami
tomcat11.0.0
bitnami
tomcat8.5.0
bitnami
tomcat9.0.83
References & sources
- https://nvd.nist.gov/vuln/detail/CVE-2025-61795advisory
- https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06web
- https://github.com/apache/tomcat/commit/af6e9181620304c0d818121c29c074e1330610d0web
- https://github.com/apache/tomcat/commit/afa422bd7ca1eef0f507259c682fd876494d9c3bweb
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlweb
- https://github.com/apache/tomcatpackage
- https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160ppweb
- https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.47web
- https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.12web
- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.110web
- http://www.openwall.com/lists/oss-security/2025/10/27/6web
- https://nvd.nist.gov/vuln/detail/CVE-2025-55668advisory
- https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6web
- https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21web
- https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95web
- https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47web
- https://tomcat.apache.org/security-10.htmlweb
- https://tomcat.apache.org/security-11.htmlweb
- https://tomcat.apache.org/security-9.htmlweb
- http://www.openwall.com/lists/oss-security/2025/08/13/3web
Linked CVEs
- CVE-2026-24734
A flaw was found in Apache Tomcat.
highCVSSv3 7.5 - CVE-2025-66614
A certificate validation flaw has been found in Apache Tomcat.
— - CVE-2025-61795
A denial of service flaw has been discovered in Apache Tomcat.
mediumCVSSv3 5.3 - CVE-2025-55754
An improper input neutralization flaw has been discovered in Apache Tomcat.
criticalCVSSv3 9.6 - CVE-2025-55752
A directory traversal vulnerability in Apache Tomcat caused by improper URL normalization during request rewriting.
highCVSSv3 7.5 - CVE-2025-55668
A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality.
mediumCVSSv3 6.5