The vulnerability in Apache Tomcat's rewrite valve involves an always-incorrect control flow implementation where if the first condition in an OR chain matches, subsequent non-OR conditions are skipped incorrectly. This flaw affects Tomcat versions 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.118, 10.1.0-M1 through 10.1.55, and 11.0.0-M1 through 11.0.22. The issue is resolved by upgrading to versions 8.5.101 or later, 9.0.119 or later, 10.1.56 or later, and 11.0.23 or later. The vulnerability has a CVSS 3.1 vector indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability at a low level. No known exploits in the wild have been reported.

This vulnerability can cause incorrect processing of rewrite rules in Apache Tomcat, potentially leading to unintended behavior in URL rewriting. The CVSS vector indicates low complexity and no required privileges, meaning it could be exploited remotely without authentication. The impact includes low-level confidentiality, integrity, and availability impacts. However, no known exploits have been reported in the wild.

A fix is available. Users should upgrade affected Apache Tomcat versions to 11.0.23, 10.1.56, 9.0.119, or 8.5.101 and later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.