> CVE-2026-65927

« BACK_TO_HOME
PUBLISHED
2026-08-25 22:17
MODIFIED
2026-08-25 22:17
EPSS (Prob. Exploit)
0.68%
Top 48.4%
DATA SOURCES:
NVD 🔗 2026-08-25 CWE MITRE 🔗 2026-09-01 FIRST EPSS 🔗 2026-10-18 OSV 🔗 2026-10-26

> DESCRIPTION

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-193

> CWE DETAILED DESCRIPTIONS

CWE-193: Off-by-one Error - A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available.
Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.5 release and security update
Red Hat JBoss Web Server 6.2.5 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has r...
Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.5 release and security update
Red Hat JBoss Web Server 6.2.5 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a...
Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.2 release and security update
Red Hat JBoss Web Server 7.0.2 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a...
Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.2 release and security update
Red Hat JBoss Web Server 7.0.2 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has r...
Red Hat Security Advisory: tomcat security update
An update for tomcat is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Co...
Red Hat Security Advisory: tomcat security update
An update for tomcat is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Co...
Red Hat Security Advisory: tomcat security update
An update for tomcat is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulne...
Red Hat Security Advisory: tomcat security, bug fix, and enhancement update
An update for tomcat is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vuln...

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

AFFECTED PACKAGES:
Unknown / Unknown
ALIASES:
BIT-tomcat-2026-65927

> HISTORIQUE DES MODIFICATIONS

Première apparition
25/08/2026 22:17
Source: NVD
📊 ENRICHISSEMENT 01/09/2026 06:02
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-193: Off-by-one Error - A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Total des modifications: 1 Dernière mise à jour: 1 month ago

> REFERENCES

https://lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4
« BACK_TO_HOME