VYPR
← All advisories
Low severityNVD Advisory· Published Feb 17, 2026· Updated Mar 11, 2026

Apache Tomcat: Security constraint bypass with HTTP/0.9

CVE-2026-24733

Description

Improper Input Validation vulnerability in Apache Tomcat.

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.

Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat.embed:tomcat-embed-coreMaven
>= 11.0.0-M1, < 11.0.1511.0.15
org.apache.tomcat.embed:tomcat-embed-coreMaven
>= 10.1.0-M1, < 10.1.5010.1.50
org.apache.tomcat.embed:tomcat-embed-coreMaven
< 9.0.1139.0.113
org.apache.tomcat:tomcatMaven
>= 11.0.0-M1, < 11.0.1511.0.15
org.apache.tomcat:tomcatMaven
>= 10.1.0-M1, < 10.1.5010.1.50
org.apache.tomcat:tomcatMaven
< 9.0.1139.0.113
org.apache.tomcat:tomcat-catalinaMaven
>= 11.0.0-M1, < 11.0.1511.0.15
org.apache.tomcat:tomcat-catalinaMaven
>= 10.1.0-M1, < 10.1.5010.1.50
org.apache.tomcat:tomcat-catalinaMaven
< 9.0.1139.0.113

Affected products

59

Patches

Vulnerability mechanics

References

9

News mentions

0

No linked articles in our index yet.