Apache Tomcat contains a vulnerability in its rewrite rule processing that allows specially crafted requests to bypass certain rewrite rules under a subset of unlikely configurations. This bypass can circumvent security constraints enforced by those rules. The issue affects multiple versions across Tomcat 8.5.x, 9.0.x, 10.1.x, and 11.0.x branches. Fixed versions are 9.0.104, 10.1.40, and 11.0.6.