CVE-2026-24733: CWE-20 Improper Input Validation in Apache Software Foundation Apache Tomcat
Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9. This issue affects Apache Tomcat: from 11.0.0 through 11.0.14, from 10.1.0 through 10.1.49, from 9.0.0 through 9.0.112. Older, EOL versions are also affected. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
AI Analysis
Technical Summary
CVE-2026-24733 is an improper input validation vulnerability in Apache Tomcat where HTTP/0.9 requests were not limited to the GET method. This allowed bypassing of security constraints that permitted HEAD requests but denied GET requests by sending a HEAD request using the HTTP/0.9 protocol, which is specification invalid. The vulnerability affects Apache Tomcat versions from 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.49, and 9.0.0-M1 through 9.0.112. The issue is fixed in versions 11.0.15 and later, 10.1.50 and later, and 9.0.113 and later.
Potential Impact
An attacker could bypass configured security constraints that differentiate between HEAD and GET requests by exploiting the improper handling of HTTP/0.9 HEAD requests. This could lead to unauthorized access to resources that should be restricted based on HTTP method constraints. The impact is limited to confidentiality and integrity with no availability impact reported.
Mitigation Recommendations
A fix is available. Users are recommended to upgrade to Apache Tomcat version 11.0.15 or later, 10.1.50 or later, or 9.0.113 or later to remediate this vulnerability.
CVE-2026-24733: CWE-20 Improper Input Validation in Apache Software Foundation Apache Tomcat
Description
Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9. This issue affects Apache Tomcat: from 11.0.0 through 11.0.14, from 10.1.0 through 10.1.49, from 9.0.0 through 9.0.112. Older, EOL versions are also affected. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
CVSS v3.1
Score 6.5medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-24733 is an improper input validation vulnerability in Apache Tomcat where HTTP/0.9 requests were not limited to the GET method. This allowed bypassing of security constraints that permitted HEAD requests but denied GET requests by sending a HEAD request using the HTTP/0.9 protocol, which is specification invalid. The vulnerability affects Apache Tomcat versions from 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.49, and 9.0.0-M1 through 9.0.112. The issue is fixed in versions 11.0.15 and later, 10.1.50 and later, and 9.0.113 and later.
Potential Impact
An attacker could bypass configured security constraints that differentiate between HEAD and GET requests by exploiting the improper handling of HTTP/0.9 HEAD requests. This could lead to unauthorized access to resources that should be restricted based on HTTP method constraints. The impact is limited to confidentiality and integrity with no availability impact reported.
Mitigation Recommendations
A fix is available. Users are recommended to upgrade to Apache Tomcat version 11.0.15 or later, 10.1.50 or later, or 9.0.113 or later to remediate this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-01-26T13:59:00.422Z
- State
- PUBLISHED
Threat ID: 699575bd80d747be205377ed
Added to database: 02/18/2026, 08:18:05 UTC
Last enriched: 06/29/2026, 22:12:26 UTC
Last updated: 09/10/2026, 19:36:53 UTC
Views: 678
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.