CVE-2026-24733: Apache Tomcat Security Constraint Bypass via HTTP/0.9 Requests
Summary
CVE-2026-24733: Apache Tomcat - Security constraint bypass with HTTP/0.9. Affects org.apache.tomcat.embed:tomcat-embed-core across 3 version ranges.
< 9.0.112
>= 10.1.0-M1, < 10.1.49
>= 11.0.0-M1, < 11.0.14
Fixed in 9.0.112, 10.1.49 or 11.0.14, depending on the release line you run. How to fix ↓
Also tracked for
- tomcat · Bitnami
The same CVE-2026-24733 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java web applications. Tomcat provides a robust environment for running Java applications, offering features such as scalability, reliability, and security. However, certain configurations can expose vulnerabilities, such as the one identified in CVE-2026-24733, which allows unauthorized access under specific conditions.
Vulnerability Detail
The vulnerability arises from improper input validation in Apache Tomcat, where HTTP/0.9 requests are not restricted to the GET method. This flaw allows users to bypass security constraints configured to allow HEAD requests while denying GET requests. By sending a specification-invalid HEAD request using HTTP/0.9, an attacker can exploit this vulnerability to access restricted resources, potentially leading to unauthorized data exposure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 9.0.1129.0.112 -
>= 10.1.0-M1, < 10.1.4910.1.49 -
>= 11.0.0-M1, < 11.0.1411.0.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to sensitive URIs by implementing additional security measures, such as IP whitelisting or using a web application firewall (WAF) to filter out HTTP/0.9 requests.
Conclusion
CVE-2026-24733 is a significant vulnerability in Apache Tomcat that allows unauthorized access through HTTP/0.9 requests. Users are strongly advised to upgrade to the latest patched versions to secure their applications. Implementing workarounds can provide temporary relief, but upgrading is the best long-term solution.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
CVE-2026-24733 is a vulnerability in Apache Tomcat that allows users to bypass security constraints through HTTP/0.9 requests.
The vulnerability affects Apache Tomcat versions from 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.49, and 9.0.0.M1 through 9.0.112.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 2.7, indicating a low severity level.
If immediate upgrading is not possible, consider implementing additional security measures such as IP whitelisting or using a web application firewall to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
