Apache Tomcat versions 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.104, 10.1.0-M1 through 10.1.40, and 11.0.0-M1 through 11.0.6 contain a vulnerability in the CGI servlet where improper handling of case sensitivity allows bypassing security constraints applied to the pathInfo component of a URI. This security constraint bypass is fixed in versions 8.5.101 and later, 9.0.105 and later, 10.1.41 and later, and 11.0.7 and later. The vulnerability has a medium severity with a CVSS score of 6.3.