Apache Tomcat contains a control flow vulnerability (CVE-2026-53404) in the RewriteValve component. The flaw causes the rewrite valve to incorrectly skip evaluation of subsequent non-OR conditions in an OR chain if the first condition matches, leading to unexpected rule processing. This can allow an attacker to bypass rewrite rules and gain unauthorized access under certain configurations. The vulnerability affects Apache Tomcat versions from 8.5.0 through 8.5.100, 9.0.0 through 9.0.118, 10.1.0 through 10.1.55, and 11.0.0 through 11.0.22. Vendor advisories from Ubuntu and Red Hat confirm the issue and provide fixed versions. Users are advised to upgrade to Apache Tomcat 11.0.23, 10.1.56, or 9.0.119 or apply vendor patches accordingly.

The vulnerability allows bypassing of rewrite rules in Apache Tomcat's RewriteValve, potentially resulting in unauthorized access to resources that should be protected by these rules. This could weaken security controls relying on rewrite rules for access restrictions. There are no reports of active exploitation in the wild. The impact is considered high due to the potential for unauthorized access.

A fix is available. Users should upgrade affected Apache Tomcat installations to versions 11.0.23, 10.1.56, or 9.0.119 or later. Ubuntu and Red Hat have released security advisories with updated package versions that address this vulnerability. Applying these vendor-provided patches or updates will remediate the issue. No additional mitigation steps are indicated by the vendor advisories.